{"updated": "2026-10-24T10:51:56.272840+00:00", "total": 6774, "new": {"1": 446, "7": 1824, "30": 2031}, "critical": 965, "exploited": 86, "p0": 86, "sevs": {"CRITICAL": 965, "HIGH": 3187, "MEDIUM": 2345, "LOW": 276}, "daily": {"2026-10-24": 42, "2026-10-22": 414, "2026-10-23": 493, "2026-10-20": 510, "2026-10-14": 17, "2026-10-21": 323, "2026-10-12": 9, "2026-10-13": 81, "2026-10-19": 42, "2026-10-16": 33, "2026-10-15": 10, "2026-10-10": 1}, "items": [{"id": "CVE-2026-115998", "publisher": "Grayback", "title": "IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca\u00a0access sensitive findings, proof-", "summary": "IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca\u00a0access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.", "cvss": 4.3, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T10:17:10.743", "modified": "2026-10-24T10:17:10.743", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115998"}], "cwe": ["CWE-639"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 15, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115994", "publisher": "Grayback", "title": "BOLA Allows Cross-Project Target Tampering\u00a0\nin Cervantes version v1.3-beta could allow an attacker modify or d", "summary": "BOLA Allows Cross-Project Target Tampering\u00a0\nin Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.", "cvss": 5.4, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T10:17:10.600", "modified": "2026-10-24T10:17:10.600", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115994"}], "cwe": ["CWE-639"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 19, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-114705", "publisher": "Patchstack", "title": "Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incor", "summary": "Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Feed Gallery: from n/a through 5.0.13.", "cvss": 6.5, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T10:17:10.453", "modified": "2026-10-24T10:17:10.453", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-114705"}], "cwe": ["CWE-862"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 28, "tier": "P3", "why": ["Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-114194", "publisher": "Patchstack", "title": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Fun", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18.", "cvss": 6.5, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T10:17:08.090", "modified": "2026-10-24T10:17:08.090", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-114194"}], "cwe": ["CWE-79"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 23, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115993", "publisher": "Grayback", "title": "Stored XSS vulnerability in the \u201cNotes\u201d field of the Checklists in Cervantes version v1.3-beta could allow an ", "summary": "Stored XSS vulnerability in the \u201cNotes\u201d field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges", "cvss": 6.8, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T09:16:44.270", "modified": "2026-10-24T09:16:44.270", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115993"}], "cwe": ["CWE-79"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 24, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-94075", "publisher": "Patchstack", "title": "Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Obje", "summary": "Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.", "cvss": 9.8, "sev": "CRITICAL", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T08:16:52.790", "modified": "2026-10-24T08:16:52.790", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-94075"}], "cwe": ["CWE-502"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 39, "tier": "P2", "why": ["Critical severity", "Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115975", "publisher": "Grayback", "title": "Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit", "summary": "Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects", "cvss": 7.1, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T08:16:52.630", "modified": "2026-10-24T08:16:52.630", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115975"}], "cwe": ["CWE-862"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 25, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-114697", "publisher": "Patchstack", "title": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA Q", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from n/a through 5.3.0.1.", "cvss": 7.1, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T08:16:52.490", "modified": "2026-10-24T08:16:52.490", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-114697"}], "cwe": ["CWE-79"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 25, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-114695", "publisher": "Patchstack", "title": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomani", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Stored XSS.This issue affects VOD Infomaniak: from n/a through 1.5.14.", "cvss": 7.1, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T08:16:52.360", "modified": "2026-10-24T08:16:52.360", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-114695"}], "cwe": ["CWE-79"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 25, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-114694", "publisher": "Patchstack", "title": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.8.", "cvss": 7.1, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T08:16:52.230", "modified": "2026-10-24T08:16:52.230", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-114694"}], "cwe": ["CWE-79"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 25, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-114693", "publisher": "Patchstack", "title": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins3", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs All-in-One Video Gallery all-in-one-video-gallery allows Stored XSS.This issue affects All-in-One Video Gallery: from n/a through 4.9.7.", "cvss": 6.5, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T08:16:52.093", "modified": "2026-10-24T08:16:52.093", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-114693"}], "cwe": ["CWE-79"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 23, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-114196", "publisher": "Patchstack", "title": "Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This", "summary": "Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.", "cvss": 9.8, "sev": "CRITICAL", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T08:16:51.963", "modified": "2026-10-24T08:16:51.963", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-114196"}], "cwe": ["CWE-502"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 39, "tier": "P2", "why": ["Critical severity", "Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-114190", "publisher": "Patchstack", "title": "Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cach", "summary": "Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Retrieve Embedded Sensitive Data.This issue affects LiteSpeed Cache: from n/a through 7.9.", "cvss": 5.9, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T08:16:51.830", "modified": "2026-10-24T08:16:51.830", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-114190"}], "cwe": ["CWE-201"], "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 26, "tier": "P3", "why": ["Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-114179", "publisher": "Patchstack", "title": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows DOM-Based XSS.This issue affects BP Better Messages: from n/a through 3.1.3.", "cvss": 7.1, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T08:16:51.700", "modified": "2026-10-24T08:16:51.700", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-114179"}], "cwe": ["CWE-79"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 25, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-114178", "publisher": "Patchstack", "title": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Gri", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cache allows Stored XSS.This issue affects W3 Total Cache: from n/a through 2.10.7.", "cvss": 7.1, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T08:16:51.567", "modified": "2026-10-24T08:16:51.567", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-114178"}], "cwe": ["CWE-79"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 25, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-112869", "publisher": "Patchstack", "title": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hea", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We\u2019re Open! opening-hours allows Reflected XSS.This issue affects We\u2019re Open!: from n/a through 2.6.", "cvss": 7.1, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T08:16:51.437", "modified": "2026-10-24T08:16:51.437", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-112869"}], "cwe": ["CWE-79"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 25, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-112866", "publisher": "Patchstack", "title": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactor", "summary": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.", "cvss": 9.3, "sev": "CRITICAL", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T08:16:51.303", "modified": "2026-10-24T08:16:51.303", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-112866"}], "cwe": ["CWE-89"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 38, "tier": "P2", "why": ["Critical severity", "Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-112844", "publisher": "Patchstack", "title": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytic", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue affects WP Event Solution: from n/a through 4.1.26.", "cvss": 7.1, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T08:16:51.160", "modified": "2026-10-24T08:16:51.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-112844"}], "cwe": ["CWE-79"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 25, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-111402", "publisher": "Patchstack", "title": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulan", "summary": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.", "cvss": 9.3, "sev": "CRITICAL", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T08:16:50.877", "modified": "2026-10-24T08:16:50.877", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-111402"}], "cwe": ["CWE-89"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 38, "tier": "P2", "why": ["Critical severity", "Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-110892", "publisher": "Patchstack", "title": "Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Config", "summary": "Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.", "cvss": 6.5, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T08:16:49.753", "modified": "2026-10-24T08:16:49.753", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-110892"}], "cwe": ["CWE-862"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 23, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115803", "publisher": "VulDB", "title": "A flaw has been found in Scada-LTS 2.8.0", "summary": "A flaw has been found in Scada-LTS 2.8.0. Affected by this vulnerability is the function HttpServletRequest.getParameter of the file AmChartValuesAPI.java of the component AmCharts Data API. Executing a manipulation of the argument ids can lead to authorization bypass. The attack can be executed remotely. The exploit has been published and may be used. The vendor announces: \"At this moment we are working on new release with security enhancements ", "cvss": 4.3, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T07:16:46.637", "modified": "2026-10-24T07:16:46.793", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115803"}], "cwe": ["CWE-285", "CWE-639"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 15, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115802", "publisher": "VulDB", "title": "A weakness has been identified in InternScience InternAgent 1.5.0", "summary": "A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/AutoChem/code/experiment.py of the component LoRA Loading. This manipulation of the argument base_model_name_or_path causes inclusion of functionality from untrusted control sphere. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.", "cvss": 4.3, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T07:16:46.273", "modified": "2026-10-24T07:16:46.273", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115802"}], "cwe": ["CWE-829"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 15, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-108013", "publisher": "HCL Software", "title": "BigFix Platform uses Mozilla CA certificate bundle (PEM)", "summary": "BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with files downloaded by the application. The issue is resolved by using bundle version 2026/10/20 or later. The fixed bundle is available starting from BES", "cvss": 6.8, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T07:16:44.990", "modified": "2026-10-24T07:16:44.990", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-108013"}], "cwe": [], "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 24, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-97353", "publisher": "WPScan", "title": "The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership chec", "summary": "The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users. This can be used to overwrite protected core metadata and tamper with content created by higher-privile", "cvss": "n/a", "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T06:16:37.610", "modified": "2026-10-24T06:16:37.610", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-97353"}], "cwe": [], "vector": null, "attack": null, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 0, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-97352", "publisher": "WPScan", "title": "The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of ", "summary": "The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor WordPress plugin before 1.4.9 from the WordPress.org repository.", "cvss": "n/a", "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T06:16:37.443", "modified": "2026-10-24T06:16:37.443", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-97352"}], "cwe": [], "vector": null, "attack": null, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 0, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-87835", "publisher": "WPScan", "title": "The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may s", "summary": "The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms, allowing unauthenticated users to assign themselves an arbitrary membership level and to mark their own account as approved, confirmed and paid, bypassing the Front End Users WordPress plugin through 3.2.35's content restrictions and its registration gating.", "cvss": "n/a", "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T06:16:37.320", "modified": "2026-10-24T06:16:37.320", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-87835"}], "cwe": [], "vector": null, "attack": null, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 0, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-114429", "publisher": "WPScan", "title": "The WPVR  WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content", "summary": "The WPVR  WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected tour.", "cvss": "n/a", "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T06:16:37.173", "modified": "2026-10-24T06:16:37.173", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-114429"}], "cwe": [], "vector": null, "attack": null, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 0, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-113674", "publisher": "WPScan", "title": "The GeoDirectory  WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by", "summary": "The GeoDirectory  WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.", "cvss": "n/a", "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T06:16:37.027", "modified": "2026-10-24T06:16:37.027", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-113674"}], "cwe": [], "vector": null, "attack": null, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 0, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-113673", "publisher": "WPScan", "title": "The GeoDirectory  WordPress plugin before 2.8.194 does not properly escape administrator-defined text before w", "summary": "The GeoDirectory  WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.", "cvss": "n/a", "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T06:16:36.907", "modified": "2026-10-24T06:16:36.907", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-113673"}], "cwe": [], "vector": null, "attack": null, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 0, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-113493", "publisher": "WPScan", "title": "The GeoDirectory  WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attri", "summary": "The GeoDirectory  WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any user viewing the affected content.", "cvss": "n/a", "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T06:16:36.773", "modified": "2026-10-24T06:16:36.773", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-113493"}], "cwe": [], "vector": null, "attack": null, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 0, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-113492", "publisher": "WPScan", "title": "The GeoDirectory  WordPress plugin before 2.8.194 does not perform status, ownership or password checks when l", "summary": "The GeoDirectory  WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public (draft, pending and private) listings by supplying their IDs.", "cvss": "n/a", "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T06:16:36.617", "modified": "2026-10-24T06:16:36.617", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-113492"}], "cwe": [], "vector": null, "attack": null, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 0, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-113491", "publisher": "WPScan", "title": "The GeoDirectory  WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it ", "summary": "The GeoDirectory  WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension. A disclosed file is re-published at a public URL and its original is deleted as a side effect.", "cvss": "n/a", "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T06:16:36.503", "modified": "2026-10-24T06:16:36.503", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-113491"}], "cwe": [], "vector": null, "attack": null, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 0, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-113490", "publisher": "WPScan", "title": "The GeoDirectory  WordPress plugin before 2.8.194 does not perform any status or ownership check when renderin", "summary": "The GeoDirectory  WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID.", "cvss": "n/a", "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T06:16:36.383", "modified": "2026-10-24T06:16:36.383", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-113490"}], "cwe": [], "vector": null, "attack": null, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 0, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-113489", "publisher": "WPScan", "title": "The GeoDirectory  WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the ", "summary": "The GeoDirectory  WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.", "cvss": "n/a", "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T06:16:36.260", "modified": "2026-10-24T06:16:36.260", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-113489"}], "cwe": [], "vector": null, "attack": null, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 0, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-112207", "publisher": "WPScan", "title": "The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to t", "summary": "The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.", "cvss": "n/a", "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T06:16:36.143", "modified": "2026-10-24T06:16:36.143", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-112207"}], "cwe": [], "vector": null, "attack": null, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 0, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-110956", "publisher": "WPScan", "title": "The asVereinbase  WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor b", "summary": "The asVereinbase  WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator.", "cvss": "n/a", "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T06:16:36.010", "modified": "2026-10-24T06:16:36.010", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-110956"}], "cwe": [], "vector": null, "attack": null, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 0, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-107907", "publisher": "WPScan", "title": "The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling", "summary": "The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce it verifies is tied only to a static action rather than to the targeted object, allowing any authenticated user with a minimal role to permanently delete arbitrary posts, pages, attachments and other content belonging to other users.", "cvss": "n/a", "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T06:16:35.877", "modified": "2026-10-24T06:16:35.877", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-107907"}], "cwe": [], "vector": null, "attack": null, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 0, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-107887", "publisher": "WPScan", "title": "The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on", "summary": "The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active  site-wide, and allowing the same action to be triggered against any logged-in user including an administrator via CSRF.", "cvss": "n/a", "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T06:16:35.727", "modified": "2026-10-24T06:16:35.727", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-107887"}], "cwe": [], "vector": null, "attack": null, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 0, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-105199", "publisher": "WPScan", "title": "The Pixel Tag Manager for WooCommerce  WordPress plugin before 2.2.3 does not perform a capability check in on", "summary": "The Pixel Tag Manager for WooCommerce  WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manager for WooCommerce  WordPress plugin before 2.2.3's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, inclu", "cvss": "n/a", "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T06:16:34.453", "modified": "2026-10-24T06:16:34.453", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-105199"}], "cwe": [], "vector": null, "attack": null, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 0, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115807", "publisher": "Wordfence", "title": "The User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor plugin for Word", "summary": "The User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role attribute directly into the `[wppb-register]` shortcode without server-side authorization. The role guard in the form builder only downgrades roles that ", "cvss": 7.1, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T05:17:06.500", "modified": "2026-10-24T05:17:06.500", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115807"}], "cwe": ["CWE-269"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 25, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115806", "publisher": "Wordfence", "title": "The Prime Mover \u2013 Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versi", "summary": "The Prime Mover \u2013 Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When a", "cvss": 9.8, "sev": "CRITICAL", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T05:17:04.900", "modified": "2026-10-24T05:17:04.900", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115806"}], "cwe": ["CWE-502"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 39, "tier": "P2", "why": ["Critical severity", "Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115929", "publisher": "MongoDB, Inc.", "title": "MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store", "summary": "MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the\u00a0recoverable\u00a0eMudhra intermediate CA certificates.\u00a0Issue is\u00a0resolved by updating to Compass 1.53.1, which includes Electron 44.9.1.", "cvss": 6.8, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-24", "pub": "2026-10-24T01:17:08.250", "modified": "2026-10-24T01:17:08.250", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115929"}], "cwe": ["CWE-295"], "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 24, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115931", "publisher": "postiz", "title": "Postiz lets a signed-in user ask the backend to run a function on one of their connected channels", "summary": "Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface.\n\nOne of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it ", "cvss": 9.9, "sev": "CRITICAL", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T23:17:43.263", "modified": "2026-10-23T23:17:43.263", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115931"}], "cwe": ["CWE-73", "CWE-470"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 35, "tier": "P2", "why": ["Critical severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115938", "publisher": "Hackrate", "title": "Craft CMS allows any authenticated control panel user to submit an element-search condition whose element sele", "summary": "Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft\u2019s allowed\u00a0column\u00a0filter delegates property lookup to Yii\u00a0ArrayHelper, outside Twig\u2019s\u00a0SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox\u2019s empty property/method allowlists.\n\n\n\nThe vulnerable condition value is ultimately cast to an integer. That does not", "cvss": 8.8, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T22:16:59.597", "modified": "2026-10-23T22:16:59.597", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115938"}], "cwe": ["CWE-1336"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 31, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115937", "publisher": "Hackrate", "title": "The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that th", "summary": "The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together:\n\n  *  commerceTransactionHash\u00a0\u2014 selects which Craft Commerce transaction is completed\n  *  id\u00a0\u2014 selects which Mollie payment is queried for its status\n\n\n\n\nAn unauthenticated attacker holding any paid Mollie payment ID from the merchant\u2019s account can pair it with any transaction hash.\n\n\n\nCommerce queries Mollie, sees\u00a0st", "cvss": 7.5, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T22:16:59.453", "modified": "2026-10-23T22:16:59.453", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115937"}], "cwe": ["CWE-345"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 31, "tier": "P3", "why": ["High severity", "Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115935", "publisher": "Hackrate", "title": "The\u00a0app/process-api-response-headers\u00a0action accepts fake Craft API response headers from any authenticated con", "summary": "The\u00a0app/process-api-response-headers\u00a0action accepts fake Craft API response headers from any authenticated control panel user.\n\n\n\nA non-admin user with only\u00a0accessCp\u00a0can place newline characters in\u00a0X-Craft-Plugin-Licenses. Craft passes this value to its\u00a0.env\u00a0writer without removing the newlines.\n\n\n\nThis lets the user insert a new attacker-known\u00a0CRAFT_SECURITY_KEY\u00a0into\u00a0.env. After Craft loads that key, the user can forge a signed login redirect co", "cvss": 8.8, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T22:16:59.290", "modified": "2026-10-23T22:16:59.290", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115935"}], "cwe": ["CWE-94"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 31, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115897", "publisher": "GitHub, Inc.", "title": "Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and ", "summary": "Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix. Because each function body is escaped independently, a delimiter supplied by surrounding serialized output can terminate an HTML script element, and a lat", "cvss": 2.1, "sev": "LOW", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T22:16:59.153", "modified": "2026-10-23T22:16:59.153", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115897"}], "cwe": ["CWE-79"], "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack": {"av": "N", "ac": "H", "pr": "L", "ui": "P"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 7, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115895", "publisher": "GitHub, Inc.", "title": "Happy DOM is a JavaScript implementation of a web browser without its graphical user interface", "summary": "Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that it is a JavaScript binding identifier before inserting it into a generated destructuring binding. With enableJavaScriptEvaluation enabled, attacker-controlled HTML or module source can use an invalid alias that be", "cvss": 8.8, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T22:16:58.987", "modified": "2026-10-23T22:16:58.987", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115895"}], "cwe": ["CWE-94"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 31, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115893", "publisher": "GitHub, Inc.", "title": "Wasmtime is a runtime for WebAssembly", "summary": "Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backe", "cvss": 9.9, "sev": "CRITICAL", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T22:16:58.820", "modified": "2026-10-23T22:16:58.947", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115893"}], "cwe": ["CWE-691"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 35, "tier": "P2", "why": ["Critical severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115892", "publisher": "GitHub, Inc.", "title": "Wasmtime is a runtime for WebAssembly", "summary": "Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns through StreamAny, FutureAny, Val::Stream, Val::Future, or an equivalent typed reader. A malicious guest that controls exported function types or returned values can cause the host to pass the type-erased value ", "cvss": 5.7, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T22:16:58.633", "modified": "2026-10-23T22:16:58.777", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115892"}], "cwe": ["CWE-248", "CWE-843"], "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack": {"av": "N", "ac": "H", "pr": "H", "ui": "P"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 20, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115889", "publisher": "GitHub, Inc.", "title": "Wasmtime is a runtime for WebAssembly", "summary": "Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm ", "cvss": 9.9, "sev": "CRITICAL", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T22:16:58.400", "modified": "2026-10-23T22:16:58.550", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115889"}], "cwe": ["CWE-197", "CWE-843"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 35, "tier": "P2", "why": ["Critical severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115887", "publisher": "GitHub, Inc.", "title": "GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas", "summary": "GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits followed by a character that makes the match fail. GraphQL evaluates parseLiteral during document validation and parseValue during variable coercion befor", "cvss": 7.5, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T22:16:58.253", "modified": "2026-10-23T22:16:58.253", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115887"}], "cwe": ["CWE-1333"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 31, "tier": "P3", "why": ["High severity", "Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115886", "publisher": "GitHub, Inc.", "title": "MLflow is an open source AI engineering platform for agents, large language models, and machine learning model", "summary": "MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, the scorer invoke, register, and GenAI evaluate endpoints, including unauthenticated POST /ajax-api/3.0/mlflow/scorer/invoke, accept serialized third-party scorer data that Scorer.model_validate_json resolves using a module-path allowlist without constraining the selected class or its constructor arguments.", "cvss": 6.5, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T22:16:58.110", "modified": "2026-10-23T22:16:58.110", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115886"}], "cwe": ["CWE-470", "CWE-918"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 28, "tier": "P3", "why": ["Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115885", "publisher": "GitHub, Inc.", "title": "The LangGraph CLI is the official command-line interface for LangGraph", "summary": "The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard input to docker login --password-stdin, but the CLI subprocess helper prints command input in verbose mode. Anyone who can read resulting CI logs or terminal recordings before the token's maximum 12-hour expiration can pull deployment images or push images to that deploymen", "cvss": 4.1, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T22:16:57.970", "modified": "2026-10-23T22:16:57.970", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115885"}], "cwe": ["CWE-532"], "vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack": {"av": "L", "ac": "L", "pr": "L", "ui": "P"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 14, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115883", "publisher": "GitHub, Inc.", "title": "LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and ", "summary": "LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels with \".\".join(namespace), while BaseStore validates labels only for put and aput. Unvalidated dotted labels passed through get, search, delete, list_names", "cvss": 6.0, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T22:16:57.820", "modified": "2026-10-23T22:16:57.820", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115883"}], "cwe": ["CWE-20", "CWE-863"], "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 21, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115801", "publisher": "VulDB", "title": "A security flaw has been discovered in Kakao khaiii up to 0.4", "summary": "A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the component JSON Config File Handler. The manipulation of the argument hidden_dim/class_num results in out-of-bounds read. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor explains: \"khaiii treats the ", "cvss": 5.3, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T22:16:57.613", "modified": "2026-10-23T22:16:57.613", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115801"}], "cwe": ["CWE-119", "CWE-125"], "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "attack": {"av": "L", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 19, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-83813", "publisher": "GitHub, Inc.", "title": "Twisted is an event-based framework for internet applications, supporting Python 3.6+", "summary": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but does not verify that the response came from the queried host and port. An attacker able to deliver a packet to the resolver's listening port with the correct transaction ID can inject a forged answer. The standard ", "cvss": 3.1, "sev": "LOW", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T21:17:25.287", "modified": "2026-10-23T21:17:25.287", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-83813"}], "cwe": ["CWE-346"], "vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "attack": {"av": "A", "ac": "H", "pr": "N", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 11, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-75525", "publisher": "GitHub, Inc.", "title": "OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform", "summary": "OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, an unauthenticated attacker can store an arbitrary ML-KEM-768 public key under any existing user's identity in any tenant's staff-crypto recipient directory. The product's design guarantees that appointment data is end-to-end encrypted to staff members and that the staff recipient directory is not attacker-writa", "cvss": 5.3, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T21:17:25.150", "modified": "2026-10-23T21:17:25.150", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-75525"}], "cwe": ["CWE-863"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 24, "tier": "P3", "why": ["Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-75524", "publisher": "GitHub, Inc.", "title": "OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform", "summary": "OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.2, an attacker overbooks an agent, placing multiple appointments into a single time slot that the system is designed to keep exclusive. The number of overlapping appointments equals the number of concurrent requests, and one booking token is enough because the token is consumed after the insert. This results in the inte", "cvss": 5.4, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T21:17:25.010", "modified": "2026-10-23T21:17:25.010", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-75524"}], "cwe": ["CWE-367"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 19, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-65825", "publisher": "GitHub, Inc.", "title": "OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform", "summary": "OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced online in the victim tenant. A successful guess yields the client's booking access token, granting access to that client's appointment tunnel, which holds their end-to-end-encrypted appointment data, and the ability to act as the client, for example ", "cvss": 7.5, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T21:17:24.870", "modified": "2026-10-23T21:17:24.870", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-65825"}], "cwe": ["CWE-307"], "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 31, "tier": "P3", "why": ["High severity", "Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-65824", "publisher": "GitHub, Inc.", "title": "OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform", "summary": "OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taking control of that account. For a staff or tenant-admin invite this yields access to the tenant context tied to that account. This issue has been patched", "cvss": 7.4, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T21:17:24.730", "modified": "2026-10-23T21:17:24.730", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-65824"}], "cwe": ["CWE-294"], "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 31, "tier": "P3", "why": ["High severity", "Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-58202", "publisher": "GitHub, Inc.", "title": "OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform", "summary": "OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails is built from the request Host header, with no allowlist. The unauthenticated POST /api/auth/resend-confirmation rotates a pending invitee's confirmation token and emails a link whose host comes from the request. An attacker who sends one resend-confirmation with Host: attacker", "cvss": 8.3, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T21:17:24.473", "modified": "2026-10-23T21:17:24.473", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-58202"}], "cwe": ["CWE-640"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 29, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115877", "publisher": "GitHub, Inc.", "title": "Twisted is an event-based framework for internet applications, supporting Python 3.6+", "summary": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF, a hidden Content-Length header can remain folded into another value while a lenient front end treats the bare character as a line terminator. The resul", "cvss": 5.4, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T21:17:23.643", "modified": "2026-10-23T21:17:23.643", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115877"}], "cwe": ["CWE-444"], "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 24, "tier": "P3", "why": ["Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115800", "publisher": "VulDB", "title": "A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2", "summary": "A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is the function load_model of the file pymllm/mobile/convertor/__init__.py of the component Convertor. The manipulation of the argument shard_file leads to path traversal. The attack needs to be performed locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded", "cvss": 5.3, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T21:17:23.467", "modified": "2026-10-23T21:17:23.467", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115800"}], "cwe": ["CWE-22"], "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "attack": {"av": "L", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 19, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115778", "publisher": "GitHub, Inc.", "title": "Twisted is an event-based framework for internet applications, supporting Python 3.6+", "summary": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.conch.telnet.Telnet.dataReceived appends every byte received after IAC SB to a persistent subnegotiation buffer until IAC SE is received, without applying a maximum length. Telnet option negotiation occurs before authentication, so an unauthenticated peer can omit the terminator and continuously grow the buffer. The resulting memory", "cvss": 7.5, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T21:17:23.320", "modified": "2026-10-23T21:17:23.320", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115778"}], "cwe": ["CWE-400", "CWE-770"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 31, "tier": "P3", "why": ["High severity", "Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115776", "publisher": "GitHub, Inc.", "title": "Twisted is an event-based framework for internet applications, supporting Python 3.6+", "summary": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inherits this behavior, and buffering occurs before PASS, NICK, or USER authentication commands. An unauthenticated connection can cont", "cvss": 7.5, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T21:17:23.180", "modified": "2026-10-23T21:17:23.180", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115776"}], "cwe": ["CWE-400", "CWE-770"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 31, "tier": "P3", "why": ["High severity", "Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115775", "publisher": "GitHub, Inc.", "title": "Twisted is an event-based framework for internet applications, supporting Python 3.6+", "summary": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. The parser retains the unfinished stanza as an in-memory tree without a byte or element-count limit, and XMPP pre-authentication stream parsing exposes this behavior before ", "cvss": 8.7, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T21:17:23.050", "modified": "2026-10-23T21:17:23.050", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115775"}], "cwe": ["CWE-400", "CWE-770"], "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 35, "tier": "P3", "why": ["High severity", "Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115774", "publisher": "GitHub, Inc.", "title": "Twisted is an event-based framework for internet applications, supporting Python 3.6+", "summary": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the client enters the selected mailbox state. The negative size moves the parser cursor below zero, and Python's negative indexing prevents the synchronous scanning loop from terminating. The loop", "cvss": 4.9, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T21:17:22.900", "modified": "2026-10-23T21:17:22.900", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115774"}], "cwe": ["CWE-400", "CWE-835"], "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "attack": {"av": "N", "ac": "L", "pr": "H", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 17, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-113951", "publisher": "Apple Inc.", "title": "If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec creden", "summary": "If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s write-config or create and then runs kubectl against it \u2014 turning filesystem access inside an untrusted Linux container into arbitrary command execution on the", "cvss": "n/a", "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T21:17:21.717", "modified": "2026-10-23T21:17:21.717", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-113951"}], "cwe": [], "vector": null, "attack": null, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 0, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-113877", "publisher": "CPANSec", "title": "HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matche", "summary": "HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions.\n\n_language_match interpolates each Accept-Language range into the pattern `/^$range\\-/i` without escaping it, so regular expression syntax in the header reaches the regex engine. A 12-byte range such as `(a?|b?){26}z` backtracks for seconds, and each increment of the quantifier doubles the time. An invalid range ", "cvss": "n/a", "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T21:17:21.597", "modified": "2026-10-23T23:17:42.620", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-113877"}], "cwe": ["CWE-624"], "vector": null, "attack": null, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 0, "tier": "P3", "why": [], "fix": false, "watched": false, "mentions": [{"src": "oss-security list", "group": "research", "title": "CVE-2026-113877: HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular ", "url": "https://seclists.org/oss-sec/2026/q4/363", "date": "2026-10-23"}], "buzz": 1, "pinned": false}, {"id": "CVE-2026-79982", "publisher": "Zephyr Project", "title": "The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copi", "summary": "The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bt_hci_tx_sync_in() allocated that buffer from bt_hci_ep_pool, a fixed pool whose slots are only USBD_MAX_BULK_MPS bytes (64 on full-speed-only builds), and then performed net_buf_add_mem(buf, bt_buf->data, bt_buf->len) with no length che", "cvss": 8.8, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T20:17:28.167", "modified": "2026-10-23T20:17:28.167", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-79982"}], "cwe": ["CWE-787"], "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "A", "ac": "L", "pr": "N", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 31, "tier": "P3", "why": ["High severity"], "fix": true, "watched": false, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:46:45.328720+00:00", "vendor_fixed": true, "pocs": [], "ssvc": null, "pinned": false}, {"id": "CVE-2026-79981", "publisher": "Zephyr Project", "title": "The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the reso", "summary": "The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised (dns_resolve_init_locked() -> register_dispatcher() -> dns_dispatcher_register()), with the local port left at 0 so the stack picks an ephemeral port exactly once. dns_write() then sends every subsequent query from that same socket without re-binding, so the source port is constant for the lifetime of the resol", "cvss": 6.5, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T20:17:28.040", "modified": "2026-10-23T20:17:28.040", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-79981"}], "cwe": ["CWE-330"], "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 28, "tier": "P3", "why": ["Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-79980", "publisher": "Zephyr Project", "title": "The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier (iface->config.dhcpv", "summary": "The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier (iface->config.dhcpv4.xid) as a counter rather than as a per-transaction random value. It was seeded once with sys_rand32_get() in dhcpv4_start_internal(), incremented by one in dhcpv4_send_discover() and dhcpv4_send_decline(), and never changed by dhcpv4_send_request() \u2014 so every RENEWING and REBINDING exchange reused, unchanged, the identifier that had alr", "cvss": 5.6, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T20:17:27.913", "modified": "2026-10-23T20:17:27.913", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-79980"}], "cwe": ["CWE-340"], "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 25, "tier": "P3", "why": ["Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-79979", "publisher": "Zephyr Project", "title": "The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm", "summary": "The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which issued TLBI VAE1{IS} with an operand of virt >> 12. That operand encodes the ASID in bits [63:48], so the invalidation only ever matched ASID 0 (the kernel page tables) and global entries. Memory domains, however, are allocated ASIDs starting at 1 in arch_mem_domain_init(), and every domain-private leaf created by pri", "cvss": 7.8, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T20:17:27.783", "modified": "2026-10-23T20:17:27.783", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-79979"}], "cwe": ["CWE-416"], "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "attack": {"av": "L", "ac": "H", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 27, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-79978", "publisher": "Zephyr Project", "title": "The RTIO streaming completion callback adxl345_process_fifo_samples_cb() in drivers/sensor/adi/adxl345/adxl345", "summary": "The RTIO streaming completion callback adxl345_process_fifo_samples_cb() in drivers/sensor/adi/adxl345/adxl345_stream.c clamps the amount of FIFO data it will report (read_len = MIN(fifo_bytes, buf_avail)) to the space actually returned by rtio_sqe_rx_buf(), but then queues one 6-byte bus read per hardware FIFO entry at consecutive offsets from read_buf, bounded by the device-reported entry count rather than by the clamp. When the allocated buffe", "cvss": 3.6, "sev": "LOW", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T20:17:27.657", "modified": "2026-10-23T20:17:27.657", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-79978"}], "cwe": ["CWE-787"], "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "attack": {"av": "L", "ac": "H", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 13, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-79977", "publisher": "Zephyr Project", "title": "The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could n", "summary": "The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handle_transport_data(), when the 32-bit receiver index of an incoming transport-data message matched no session, the code both scheduled a new handshake and copied the datagram's source address into peer->endpoint with memcpy(&peer->endpoint, peer_addr, sizeof(peer->endpoint)). Because the receiver index is unknown, t", "cvss": 8.2, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T20:17:27.523", "modified": "2026-10-23T20:17:27.523", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-79977"}], "cwe": ["CWE-306", "CWE-346"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 34, "tier": "P3", "why": ["High severity", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:37:12.802530+00:00", "vendor_fixed": true, "pocs": [], "ssvc": null, "pinned": false}, {"id": "CVE-2026-19741", "publisher": "Zephyr Project", "title": "Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default \"J01NME\" in modules/openthr", "summary": "Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default \"J01NME\" in modules/openthread/Kconfig.thread (previously subsys/net/l2/openthread/Kconfig, then subsys/net/l2/openthread/Kconfig.thread). J01NME is the example Joining Device Credential used throughout the public OpenThread and Thread commissioning documentation, including Zephyr's own samples/net/sockets/echo_client/README.rst, so it is not a secret. A firmware i", "cvss": 7.5, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T20:17:21.867", "modified": "2026-10-23T20:17:21.867", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-19741"}], "cwe": ["CWE-1392"], "vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "A", "ac": "H", "pr": "N", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 26, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115797", "publisher": "VulDB", "title": "A weakness has been identified in Tenda F6 12.02.01.73", "summary": "A weakness has been identified in Tenda F6 12.02.01.73. Affected is an unknown function of the component Web Management Interface. Executing a manipulation of the argument ecos_pw can lead to cleartext transmission of sensitive information. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been made available to the public and could be used for attacks", "cvss": 3.7, "sev": "LOW", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T20:17:21.693", "modified": "2026-10-23T20:17:21.693", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115797"}], "cwe": ["CWE-310", "CWE-319"], "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 18, "tier": "P3", "why": ["Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115796", "publisher": "VulDB", "title": "A security flaw has been discovered in Tenda F6 12.02.01.73", "summary": "A security flaw has been discovered in Tenda F6 12.02.01.73. This impacts an unknown function of the component Web Management Interface. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.", "cvss": 4.3, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T20:17:21.507", "modified": "2026-10-23T20:17:21.507", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115796"}], "cwe": ["CWE-352", "CWE-862"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 15, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115586", "publisher": "GitHub, Inc.", "title": "virtualenv is a tool for creating isolated virtual python environments", "summary": "virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation. Re-enabling promptvars, running set -o posix, or starting an interactive child bash that inherits the exported PS1 can then expand command substitution i", "cvss": 7.1, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T20:17:21.363", "modified": "2026-10-23T21:17:22.793", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115586"}], "cwe": ["CWE-78"], "vector": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack": {"av": "L", "ac": "H", "pr": "N", "ui": "A"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 25, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115585", "publisher": "GitHub, Inc.", "title": "pypdf is a free and open-source pure-python PDF library", "summary": "pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during each recovery attempt even when a recovery cache was present, causing crafted cross-reference streams to produce long runtimes. This issue is fixed in version 6.21.2.", "cvss": 7.1, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T20:17:21.230", "modified": "2026-10-23T20:17:21.230", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115585"}], "cwe": ["CWE-400", "CWE-407"], "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "P"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 25, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115580", "publisher": "GitHub, Inc.", "title": "pypdf is a free and open-source pure-python PDF library", "summary": "pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.", "cvss": 7.1, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T20:17:21.087", "modified": "2026-10-23T20:17:21.087", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115580"}], "cwe": ["CWE-834"], "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "P"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 25, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115572", "publisher": "GitHub, Inc.", "title": "pypdf is a free and open-source pure-python PDF library", "summary": "pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue is fixed in version 6.21.2.", "cvss": 7.1, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T20:17:20.940", "modified": "2026-10-23T20:17:20.940", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115572"}], "cwe": ["CWE-400"], "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "P"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 25, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-91093", "publisher": "HP Inc.", "title": "A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might", "summary": "A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation\n               of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate the potential vulnerability.", "cvss": 8.5, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T19:17:45.287", "modified": "2026-10-24T04:18:21.037", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-91093"}], "cwe": ["CWE-427"], "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack": {"av": "L", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 30, "tier": "P3", "why": ["High severity"], "fix": true, "watched": false, "vendors": [{"os": "Fedora 46", "pkg": "diffoscope", "status": "fixed", "fixed": "335-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-e4c4cc0856", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-e4c4cc0856", "note": "FEDORA-2026-e4c4cc0856"}], "vendors_checked": "2026-10-23T19:07:39.226902+00:00", "vendor_fixed": true, "pocs": [], "ssvc": null, "pinned": false}, {"id": "CVE-2026-115845", "publisher": "AMZN", "title": "An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server ", "summary": "An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary code within their own isolated session environment via a crafted script.\n\n\n\nAWS fixed this issue service-side. No customer action is required.", "cvss": 6.4, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T19:17:44.643", "modified": "2026-10-23T19:23:01.467", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115845"}], "cwe": ["CWE-184"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 27, "tier": "P3", "why": ["On your watchlist"], "fix": false, "watched": true, "mentions": [{"src": "AWS Security Bulletins", "group": "vendor", "title": "CVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP Server", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-149-aws/", "date": "2026-10-23"}], "buzz": 1, "pinned": false}, {"id": "CVE-2026-115570", "publisher": "GitHub, Inc.", "title": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS", "summary": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromium networking, Node.js tls, Node.js https, or Node.js fetch. An attacker who holds a certificate issued through one of these intermediates and can intercept network traffic can impersonate a TLS server to an affec", "cvss": 7.4, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T19:17:44.470", "modified": "2026-10-23T21:17:22.657", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115570"}], "cwe": ["CWE-299"], "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 31, "tier": "P3", "why": ["High severity", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:46:45.328720+00:00", "vendor_fixed": true, "pocs": [], "ssvc": null, "pinned": false}, {"id": "CVE-2026-115569", "publisher": "GitHub, Inc.", "title": "Fallow is a codebase intelligence tool for TypeScript and JavaScript", "summary": "Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior also affects Vitest test.projects paths, Vitest inline-project extends paths, and symlinked script --config paths. Fallow parses the outside files as test", "cvss": 3.3, "sev": "LOW", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T19:17:44.320", "modified": "2026-10-23T19:57:42.660", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115569"}], "cwe": ["CWE-22", "CWE-59"], "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attack": {"av": "L", "ac": "L", "pr": "N", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 12, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-112342", "publisher": "VulnCheck", "title": "Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py tha", "summary": "Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only on user id while omitting the active space, with the cached entry's TTL refreshed on every request. Attackers can create their own space to obtain an admin group designation, then switch their active space to a", "cvss": 7.1, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T19:17:43.203", "modified": "2026-10-23T21:17:21.483", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-112342"}], "cwe": ["CWE-863"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 25, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115863", "publisher": "MITRE", "title": "ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message", "summary": "ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded \"c += jump + 1\" loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of >= 1025 non-zero bytes makes the label wal", "cvss": 7.6, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T18:17:21.757", "modified": "2026-10-23T19:43:46.190", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115863"}], "cwe": ["CWE-121"], "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "attack": {"av": "A", "ac": "L", "pr": "N", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 27, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115813", "publisher": "AMZN", "title": "Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and ea", "summary": "Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to send requests to internal network destinations via a crafted model URL.\n\n\n\nMulti Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.", "cvss": 5.8, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T18:17:21.617", "modified": "2026-10-23T19:23:01.467", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115813"}], "cwe": ["CWE-918"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 30, "tier": "P3", "why": ["Remotely exploitable, no login, no user action", "On your watchlist"], "fix": true, "watched": true, "vendors": [{"os": "Fedora 46", "pkg": "diffoscope", "status": "fixed", "fixed": "335-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-e4c4cc0856", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-e4c4cc0856", "note": "FEDORA-2026-e4c4cc0856"}], "vendors_checked": "2026-10-23T19:07:39.226902+00:00", "vendor_fixed": true, "pocs": [], "ssvc": null, "mentions": [{"src": "AWS Security Bulletins", "group": "vendor", "title": "CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-148-aws/", "date": "2026-10-23"}], "buzz": 1, "pinned": false}, {"id": "CVE-2026-115812", "publisher": "AMZN", "title": "Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and e", "summary": "Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive.\n\n\n\nMulti Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.", "cvss": 9.8, "sev": "CRITICAL", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T18:17:21.460", "modified": "2026-10-23T19:23:01.467", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115812"}], "cwe": ["CWE-23"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 44, "tier": "P2", "why": ["Critical severity", "Remotely exploitable, no login, no user action", "On your watchlist"], "fix": true, "watched": true, "vendors": [{"os": "Fedora 46", "pkg": "wasmedge", "status": "fixed", "fixed": "0.18.1-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-4c27216e39", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-4c27216e39", "note": "FEDORA-2026-4c27216e39"}], "vendors_checked": "2026-10-23T17:50:44.744827+00:00", "vendor_fixed": true, "pocs": [], "ssvc": null, "mentions": [{"src": "AWS Security Bulletins", "group": "vendor", "title": "CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-148-aws/", "date": "2026-10-23"}], "buzz": 1, "pinned": false}, {"id": "CVE-2026-115567", "publisher": "GitHub, Inc.", "title": "Tokio is a runtime for writing applications with Rust", "summary": "Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the multi-threaded runtime's time driver could drop an internal timer entry without synchronizing with the driver thread that was firing it. The race caused a use-after-free on the timer's waker and task state in safe Rust, which could produce assertion panics, task reference-count corruption, o", "cvss": 5.8, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T18:17:21.303", "modified": "2026-10-23T19:42:24.553", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115567"}], "cwe": ["CWE-362"], "vector": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack": {"av": "L", "ac": "H", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 20, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-110975", "publisher": "Red Hat, Inc.", "title": "A flaw was found in Kruize Autotune", "summary": "A flaw was found in Kruize Autotune. Its REST API ships without an authentication layer, and the endpoints that return datasource configuration \u2014 the list-datasources endpoint (GET /datasources) and the datasource-metadata endpoint \u2014 serialized datasource objects using a default Gson configuration with no field-exclusion strategy. As a result, the authentication secrets stored for each configured monitoring datasource (basic-auth passwords, beare", "cvss": 7.4, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T18:17:20.503", "modified": "2026-10-23T21:17:21.247", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-110975"}], "cwe": ["CWE-256"], "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "attack": {"av": "A", "ac": "L", "pr": "N", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 26, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-87901", "publisher": "HackerOne", "title": "Improper sanitization in the registration module allows reflected Cross-Site Scripting.", "summary": "Improper sanitization in the registration module allows reflected Cross-Site Scripting.", "cvss": 8.3, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T17:17:22.137", "modified": "2026-10-23T17:17:22.250", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-87901"}], "cwe": ["CWE-79"], "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 29, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-115810", "publisher": "VulnCheck", "title": "Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that ", "summary": "Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to issue GET requests to arbitrary internal or external hosts by crafting a malicious image URL in a Pestle JSON import file. Attackers can exploit the raw requests.get call in cookbook/integration/pestle.py, which bypasses the application's centralized requests-hardened SSRF f", "cvss": 7.7, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T17:17:21.380", "modified": "2026-10-23T19:57:42.660", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115810"}], "cwe": ["CWE-918"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 27, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-106074", "publisher": "HackerOne", "title": "A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUI", "summary": "A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`.\n\nIf any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns t", "cvss": 4.8, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T17:17:20.473", "modified": "2026-10-23T19:42:24.553", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-106074"}], "cwe": ["CWE-330"], "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 22, "tier": "P3", "why": ["Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-106073", "publisher": "HackerOne", "title": "A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read", "summary": "A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`.\n\nAs a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directorie", "cvss": 3.3, "sev": "LOW", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T17:17:20.343", "modified": "2026-10-23T19:42:24.553", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-106073"}], "cwe": ["CWE-284"], "vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "attack": {"av": "L", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 12, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-106072", "publisher": "HackerOne", "title": "A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP end", "summary": "A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`.\n\n`tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.", "cvss": 6.7, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T17:17:20.203", "modified": "2026-10-23T19:42:24.553", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-106072"}], "cwe": ["CWE-295"], "vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L", "attack": {"av": "N", "ac": "L", "pr": "H", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 23, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-106071", "publisher": "HackerOne", "title": "A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildca", "summary": "A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.\n\nWhen the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the roo", "cvss": 3.6, "sev": "LOW", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T17:17:20.060", "modified": "2026-10-23T19:42:24.553", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-106071"}], "cwe": ["CWE-284"], "vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "attack": {"av": "L", "ac": "H", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 13, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-106070", "publisher": "HackerOne", "title": "A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entr", "summary": "A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails.\n\nWhen `zipEntry.modified` is read on an archive whose local header does not match its central directory, either directly or while compacting the archive, the validation error is caught but the parsed local header is left cached without a content offset. A later content read then retur", "cvss": 3.7, "sev": "LOW", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T17:17:19.917", "modified": "2026-10-23T19:42:24.553", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-106070"}], "cwe": ["CWE-840"], "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 18, "tier": "P3", "why": ["Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-106069", "publisher": "HackerOne", "title": "A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different", "summary": "A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`.\n\n`tls.checkServerIdentity()` normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the connection is made through the ope", "cvss": 7.4, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T17:17:19.740", "modified": "2026-10-23T19:42:24.553", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-106069"}], "cwe": ["CWE-295"], "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 31, "tier": "P3", "why": ["High severity", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "vendors": [{"os": "Fedora 46", "pkg": "gum", "status": "fixed", "fixed": "2.0.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-da0d6dd894", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-da0d6dd894", "note": "FEDORA-2026-da0d6dd894"}, {"os": "Debian 12", "pkg": "nodejs", "status": "vulnerable", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Debian 13", "pkg": "nodejs", "status": "vulnerable", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Alpine 3.21", "pkg": "nodejs", "status": "fixed", "fixed": "nodejs-22.23.4-r0", "cmd": "apk add --upgrade nodejs\napk info -v nodejs", "url": null, "note": null}, {"os": "Alpine 3.22", "pkg": "nodejs", "status": "fixed", "fixed": "nodejs-22.23.4-r0", "cmd": "apk add --upgrade nodejs\napk info -v nodejs", "url": null, "note": null}, {"os": "Alpine 3.23", "pkg": "nodejs", "status": "fixed", "fixed": "nodejs-24.22.1-r0", "cmd": "apk add --upgrade nodejs\napk info -v nodejs", "url": null, "note": null}, {"os": "Alpine 3.24", "pkg": "nodejs", "status": "fixed", "fixed": "nodejs-24.22.1-r0", "cmd": "apk add --upgrade nodejs\napk info -v nodejs", "url": null, "note": null}], "vendors_checked": "2026-10-23T18:49:29.362322+00:00", "vendor_fixed": true, "pocs": [], "ssvc": null, "pinned": false}, {"id": "CVE-2026-105483", "publisher": "HackerOne", "title": "A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenti", "summary": "A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`\uff11\uff12\uff17.0.0.1`).\n\n`tls.checkServerIdentity()` did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name ins", "cvss": 7.4, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T17:17:19.573", "modified": "2026-10-23T19:42:24.553", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-105483"}], "cwe": ["CWE-295"], "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 31, "tier": "P3", "why": ["High severity", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "vendors": [{"os": "Fedora 46", "pkg": "gum", "status": "fixed", "fixed": "2.0.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-da0d6dd894", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-da0d6dd894", "note": "FEDORA-2026-da0d6dd894"}, {"os": "Debian 12", "pkg": "nodejs", "status": "vulnerable", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Debian 13", "pkg": "nodejs", "status": "vulnerable", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Alpine 3.23", "pkg": "nodejs", "status": "fixed", "fixed": "nodejs-24.22.1-r0", "cmd": "apk add --upgrade nodejs\napk info -v nodejs", "url": null, "note": null}, {"os": "Alpine 3.24", "pkg": "nodejs", "status": "fixed", "fixed": "nodejs-24.22.1-r0", "cmd": "apk add --upgrade nodejs\napk info -v nodejs", "url": null, "note": null}], "vendors_checked": "2026-10-23T18:49:29.362322+00:00", "vendor_fixed": true, "pocs": [], "ssvc": null, "pinned": false}, {"id": "CVE-2026-105482", "publisher": "HackerOne", "title": "A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.re", "summary": "A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.\r\n\r\nBecause the name is passed to c-ares as a C string, resolving attacker.example\\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate ", "cvss": 7.4, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T17:17:19.427", "modified": "2026-10-23T19:42:24.553", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-105482"}], "cwe": ["CWE-284"], "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 31, "tier": "P3", "why": ["High severity", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "vendors": [{"os": "Fedora 46", "pkg": "gum", "status": "fixed", "fixed": "2.0.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-da0d6dd894", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-da0d6dd894", "note": "FEDORA-2026-da0d6dd894"}, {"os": "Debian 12", "pkg": "nodejs", "status": "vulnerable", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Debian 13", "pkg": "nodejs", "status": "vulnerable", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Alpine 3.21", "pkg": "nodejs", "status": "fixed", "fixed": "nodejs-22.23.4-r0", "cmd": "apk add --upgrade nodejs\napk info -v nodejs", "url": null, "note": null}, {"os": "Alpine 3.22", "pkg": "nodejs", "status": "fixed", "fixed": "nodejs-22.23.4-r0", "cmd": "apk add --upgrade nodejs\napk info -v nodejs", "url": null, "note": null}, {"os": "Alpine 3.23", "pkg": "nodejs", "status": "fixed", "fixed": "nodejs-24.22.1-r0", "cmd": "apk add --upgrade nodejs\napk info -v nodejs", "url": null, "note": null}, {"os": "Alpine 3.24", "pkg": "nodejs", "status": "fixed", "fixed": "nodejs-24.22.1-r0", "cmd": "apk add --upgrade nodejs\napk info -v nodejs", "url": null, "note": null}], "vendors_checked": "2026-10-23T18:49:29.362322+00:00", "vendor_fixed": true, "pocs": [{"kind": "poc", "name": "CaterMaoZi/CVE-2026-105482-POC (8 stars)", "url": "https://github.com/CaterMaoZi/CVE-2026-105482-POC", "stars": 8}], "ssvc": null, "pinned": false}, {"id": "CVE-2026-105481", "publisher": "HackerOne", "title": "A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent b", "summary": "A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.\n\nThe guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for e", "cvss": 6.5, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T17:17:19.250", "modified": "2026-10-23T19:42:24.553", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-105481"}], "cwe": ["CWE-367"], "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 28, "tier": "P3", "why": ["Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-57845", "publisher": "VulnCheck", "title": "Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers t", "summary": "Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed by Pandas._generate_tables via pandas.read_pickle() without validation, so when a victim calls datasets.load_dataset(\"pandas\", data_files=...), the embedd", "cvss": 8.8, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T16:16:52.000", "modified": "2026-10-23T19:45:03.547", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-57845"}], "cwe": ["CWE-502"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 31, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "vendors": [], "vendors_checked": "2026-10-23T16:02:19.453775+00:00", "vendor_fixed": false, "pinned": false}, {"id": "CVE-2026-52356", "publisher": "MITRE", "title": "An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WW", "summary": "An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.", "cvss": "n/a", "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T16:16:51.870", "modified": "2026-10-23T19:57:42.660", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-52356"}], "cwe": [], "vector": null, "attack": null, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 0, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-50787", "publisher": "MITRE", "title": "e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in rest", "summary": "e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php. The application uses user-supplied parameters (l, a, tf, ql) without validation to generate CAPTCHA images, allowing remote attackers to cause denial of service via excessive memory and CPU consumption.", "cvss": "n/a", "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T16:16:51.733", "modified": "2026-10-23T19:57:42.660", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-50787"}], "cwe": [], "vector": null, "attack": null, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 0, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2025-45528", "publisher": "MITRE", "title": "An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary co", "summary": "An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF", "cvss": "n/a", "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T16:16:50.607", "modified": "2026-10-23T19:43:46.190", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2025-45528"}], "cwe": [], "vector": null, "attack": null, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 0, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-58497", "publisher": "GitHub, Inc.", "title": "Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tool", "summary": "Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A malicious web page could send a CORS simple POST request, such as text/plain, to the local /mcp endpoint and deliver a JSON-RPC body to the dispatcher. If the us", "cvss": 8.6, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T15:17:34.257", "modified": "2026-10-23T21:17:24.620", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-58497"}], "cwe": ["CWE-346", "CWE-352"], "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "P"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 30, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "vendors": [], "vendors_checked": "2026-10-23T15:02:04.936815+00:00", "vendor_fixed": false, "pinned": false}, {"id": "CVE-2026-55486", "publisher": "GitHub, Inc.", "title": "The Goobi viewer is a web application that allows digitised material to be displayed in a web browser", "summary": "The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then (1) embed it into the Content-Security-Policy: frame-ancestors response header and (2) embed it into an HTML response body as a JavaScript single-quoted postMe", "cvss": 9.3, "sev": "CRITICAL", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T15:17:33.657", "modified": "2026-10-23T16:28:32.357", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-55486"}], "cwe": ["CWE-79", "CWE-113", "CWE-1336"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 33, "tier": "P2", "why": ["Critical severity"], "fix": false, "watched": false, "vendors": [], "vendors_checked": "2026-10-23T14:52:14.700663+00:00", "vendor_fixed": false, "pinned": false}, {"id": "CVE-2026-55465", "publisher": "GitHub, Inc.", "title": "The Goobi viewer is a web application that allows digitised material to be displayed in a web browser", "summary": "The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/{solrField}/spatial/search concatenates the user-supplied region query parameter directly into a Solr query string with no escaping, no local-param stripping, and no runtime schema enforcement (the OpenAPI @Schema(pattern=...) annotation is documentat", "cvss": 5.3, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T15:17:33.500", "modified": "2026-10-23T16:28:32.357", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-55465"}], "cwe": ["CWE-89", "CWE-943"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 24, "tier": "P3", "why": ["Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-55463", "publisher": "GitHub, Inc.", "title": "The Goobi viewer is a web application that allows digitised material to be displayed in a web browser", "summary": "The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core (DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint) accept connections without verifying that the associated HttpSession belongs to a logged-in user, and none validate the Origin header against an allowlist. An unauthent", "cvss": 6.5, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T15:17:33.360", "modified": "2026-10-23T16:28:32.357", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-55463"}], "cwe": ["CWE-306", "CWE-862", "CWE-1385"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 28, "tier": "P3", "why": ["Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-55459", "publisher": "GitHub, Inc.", "title": "The Goobi viewer is a web application that allows digitised material to be displayed in a web browser", "summary": "The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.require(algorithm).withIssuer(issuer).build() and does not enforce the aud claim during cryptographic validation. The aud check is performed manually afterwards via a single string-equality call, which only handles single-string aud va", "cvss": 7.4, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T15:17:33.207", "modified": "2026-10-23T16:28:32.357", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-55459"}], "cwe": ["CWE-287", "CWE-345"], "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 31, "tier": "P3", "why": ["High severity", "Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "vendors": [], "vendors_checked": "2026-10-23T14:52:14.700663+00:00", "vendor_fixed": false, "pinned": false}, {"id": "CVE-2026-55457", "publisher": "GitHub, Inc.", "title": "The Goobi viewer is a web application that allows digitised material to be displayed in a web browser", "summary": "The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compares the supplied token against this default without first checking that the configured token is non-empty. A request to any @AuthorizationBinding-protected endpoint with an empty ?token= value ", "cvss": 7.4, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T15:17:33.060", "modified": "2026-10-23T16:28:32.357", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-55457"}], "cwe": ["CWE-287", "CWE-1392"], "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 31, "tier": "P3", "why": ["High severity", "Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "vendors": [], "vendors_checked": "2026-10-23T14:52:14.700663+00:00", "vendor_fixed": false, "pinned": false}, {"id": "CVE-2026-55444", "publisher": "GitHub, Inc.", "title": "The Goobi viewer is a web application that allows digitised material to be displayed in a web browser", "summary": "The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet (RssResolver, GET /rss/) accepts the q and filterQuery parameters and concatenates them into Solr queries without validation. The servlet predates the REST API layer and lacks the input validation present in GET /api/v1/records/rss. q forms the main query body (wrapped only in literal parentheses); ", "cvss": 5.3, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T15:17:32.910", "modified": "2026-10-23T16:28:32.357", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-55444"}], "cwe": ["CWE-20", "CWE-89", "CWE-943"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 24, "tier": "P3", "why": ["Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-55442", "publisher": "GitHub, Inc.", "title": "The Goobi viewer is a web application that allows digitised material to be displayed in a web browser", "summary": "The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery() strips Solr local-parameter syntax ({!...}) from user-supplied query strings before they reach Solr. Its regex can be bypassed by wrapping the local parameter in a second pair of curly braces ({{!...}}): the outer braces are stripped, the inner {!...} survives intact, and a val", "cvss": 5.3, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T15:17:32.730", "modified": "2026-10-23T16:28:32.357", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-55442"}], "cwe": ["CWE-20", "CWE-116"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 24, "tier": "P3", "why": ["Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-55222", "publisher": "GitHub, Inc.", "title": "Isar is an integration system for automated root filesystem generation", "summary": "Isar is an integration system for automated root filesystem generation. In versions 0.11 and newer, /etc/apt/trusted.gpg.d is created manually during bootstrap setup to be able to deploy local keys. By that, the directory is owned by the calling user (the one that executes Isar) instead of root. If the calling user's id is identical to one of an unprivileged user inside the image, this user is able to alter existing keys and deploy new ones, sile", "cvss": 5.1, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T15:17:32.563", "modified": "2026-10-23T21:17:24.003", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-55222"}], "cwe": ["CWE-1290"], "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "attack": {"av": "L", "ac": "H", "pr": "N", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 18, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-54668", "publisher": "GitHub, Inc.", "title": "Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Librar", "summary": "Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The methods parseXMLString(String), getNumberOfEADElements(String, String) and checkIfXmlIsWellFormed(String) build a DocumentBuilderFactory / XMLInputFactory /", "cvss": 8.7, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T15:17:32.427", "modified": "2026-10-23T19:57:42.660", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-54668"}], "cwe": ["CWE-611"], "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 30, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "vendors": [], "vendors_checked": "2026-10-23T16:02:19.453775+00:00", "vendor_fixed": false, "pinned": false}, {"id": "CVE-2026-53942", "publisher": "GitHub, Inc.", "title": "Conda Organization Infrastructure is a centralized location for infrastructure codes", "summary": "Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain present in conda/conda. The affected workflow is .github/workflows/update.yml. It is triggered by issue_comment events containing @conda-bot render or @conda-bot recreate. For the render path, the workflow obtains the pull request head repository and branch from the PR API, che", "cvss": 9.9, "sev": "CRITICAL", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T15:17:32.157", "modified": "2026-10-23T19:42:24.553", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-53942"}], "cwe": ["CWE-94"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 35, "tier": "P2", "why": ["Critical severity"], "fix": false, "watched": false, "vendors": [], "vendors_checked": "2026-10-23T14:52:14.700663+00:00", "vendor_fixed": false, "pinned": false}, {"id": "CVE-2026-49442", "publisher": "GitHub, Inc.", "title": "Cacti is an open source performance and fault management framework", "summary": "Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on the Cacti service. When a user attempts to log in, the application returns slightly different error messages depending on whether the provided username exists in the system. When username exists on Cacti, in the response, they see Access Denied! Login failed. When it does n", "cvss": 5.3, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T15:17:32.003", "modified": "2026-10-23T19:36:32.410", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-49442"}], "cwe": ["CWE-204"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 24, "tier": "P3", "why": ["Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-46652", "publisher": "GitHub, Inc.", "title": "The Goobi viewer is a web application that allows digitised material to be displayed in a web browser", "summary": "The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename() extracts the destination filename from a server-supplied Content-Disposition response header and passes it directly to Path.resolve() without stripping directory components. This allows for a malicious HTTP server that the viewer fetches from to supply an absolute ", "cvss": 9.8, "sev": "CRITICAL", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T15:17:31.593", "modified": "2026-10-23T16:28:32.357", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-46652"}], "cwe": ["CWE-22", "CWE-73"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 39, "tier": "P2", "why": ["Critical severity", "Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "vendors": [], "vendors_checked": "2026-10-23T14:52:14.700663+00:00", "vendor_fixed": false, "pinned": false}, {"id": "CVE-2026-46651", "publisher": "GitHub, Inc.", "title": "The Goobi viewer is a web application that allows digitised material to be displayed in a web browser", "summary": "The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.", "cvss": 9.8, "sev": "CRITICAL", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T15:17:31.453", "modified": "2026-10-23T16:28:32.357", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-46651"}], "cwe": ["CWE-306", "CWE-552", "CWE-918"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 39, "tier": "P2", "why": ["Critical severity", "Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "vendors": [], "vendors_checked": "2026-10-23T14:52:14.700663+00:00", "vendor_fixed": false, "pinned": false}, {"id": "CVE-2026-46531", "publisher": "GitHub, Inc.", "title": "Cacti is an open source performance and fault management framework", "summary": "Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL injection in the automation tree rule item handler. A user holding the Automation realm (default General Administration role) can persist an arbitrary SQL fragment in the automation_tree_rule_items.field column. The fragment is later concatenated directly into a SELECT ... AS sou", "cvss": 5.5, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T15:17:31.317", "modified": "2026-10-23T19:36:32.410", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-46531"}], "cwe": ["CWE-89"], "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N", "attack": {"av": "N", "ac": "L", "pr": "H", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 19, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-46347", "publisher": "GitHub, Inc.", "title": "The Goobi viewer is a web application that allows digitised material to be displayed in a web browser", "summary": "The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the application generates a replacement password in a predictable way and emails it to the account holder. The insufficient entropy allows the password to be brute-forced by an attacker who can approximate the server-side generation time. Exploiting this finding in isolation requires", "cvss": 6.8, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T15:17:31.180", "modified": "2026-10-23T16:28:32.357", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-46347"}], "cwe": ["CWE-330", "CWE-340", "CWE-640"], "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 24, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-46346", "publisher": "GitHub, Inc.", "title": "The Goobi viewer is a web application that allows digitised material to be displayed in a web browser", "summary": "The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based on the time of the reset request. An attacker who knows the target's email address can request a reset and then brute-force the token. Exploiting this finding alone forces an unauthorized password reset on any account. This issue has been patched in version 26.05.", "cvss": 6.5, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T15:17:31.030", "modified": "2026-10-23T21:17:23.793", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-46346"}], "cwe": ["CWE-330", "CWE-340", "CWE-640"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 28, "tier": "P3", "why": ["Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-39902", "publisher": "GitHub, Inc.", "title": "Cacti is an open source performance and fault management framework", "summary": "Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\\\n\\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string` containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31.", "cvss": 7.2, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T15:17:30.873", "modified": "2026-10-23T19:36:32.410", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-39902"}], "cwe": ["CWE-78"], "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "H", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 25, "tier": "P3", "why": ["High severity"], "fix": true, "watched": false, "vendors": [{"os": "Alpine 3.24", "pkg": "cacti", "status": "fixed", "fixed": "cacti-1.2.31-0", "cmd": "apk add --upgrade cacti\napk info -v cacti", "url": null, "note": null}], "vendors_checked": "2026-10-23T15:02:04.936815+00:00", "vendor_fixed": true, "pinned": false}, {"id": "CVE-2026-115478", "publisher": "GitHub, Inc.", "title": "obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults", "summary": "obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate memory notes from SQLite at the computed `memory/<type>/<name>.md` path without reliably preserving note ownership or the consistency of a failed lifecycle operation. During shared materialization, a hand-authored note or an orphan lef", "cvss": 7.1, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T15:17:30.023", "modified": "2026-10-23T15:17:30.147", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115478"}], "cwe": ["CWE-459", "CWE-863"], "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 25, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "vendors": [], "vendors_checked": "2026-10-23T14:52:14.700663+00:00", "vendor_fixed": false, "pinned": false}, {"id": "CVE-2026-115477", "publisher": "GitHub, Inc.", "title": "obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults", "summary": "obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with `auth.jwtSecret` configured and a 2026-07-28-era client declaring `elicitation.form` support, a dispatch-gated tool call offered an `inputRequired` confirmation could still complete after the human declined or cancelled, or the elicitation response was omitted or malformed, provided the client ec", "cvss": 7.1, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T15:17:29.840", "modified": "2026-10-23T15:17:29.967", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-115477"}], "cwe": ["CWE-285", "CWE-863"], "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 25, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "vendors": [], "vendors_checked": "2026-10-23T14:52:14.700663+00:00", "vendor_fixed": false, "pinned": false}, {"id": "CVE-2026-112333", "publisher": "VulnCheck", "title": "GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled r", "summary": "GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored by ReportScheduling.btnSaveReport_Click() without output encoding and is executed in the browser of the user who created the scheduled report when they ", "cvss": 5.4, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T15:17:24.487", "modified": "2026-10-23T15:17:24.603", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-112333"}], "cwe": ["CWE-79"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 19, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-106765", "publisher": "MITRE", "title": "An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleIma", "summary": "An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.", "cvss": 7.5, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T15:17:23.333", "modified": "2026-10-23T19:57:42.660", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-106765"}], "cwe": [], "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 31, "tier": "P3", "why": ["High severity", "On your watchlist"], "fix": false, "watched": true, "vendors": [], "vendors_checked": "2026-10-23T16:02:19.453775+00:00", "vendor_fixed": false, "pinned": false}, {"id": "CVE-2026-106764", "publisher": "MITRE", "title": "An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseB", "summary": "An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.", "cvss": 7.5, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T15:17:23.203", "modified": "2026-10-23T19:57:42.660", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-106764"}], "cwe": [], "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 26, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "vendors": [], "vendors_checked": "2026-10-23T15:02:04.936815+00:00", "vendor_fixed": false, "pinned": false}, {"id": "CVE-2026-106763", "publisher": "MITRE", "title": "An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the ", "summary": "An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.", "cvss": 7.5, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T15:17:23.063", "modified": "2026-10-23T19:57:42.660", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-106763"}], "cwe": [], "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 26, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "vendors": [], "vendors_checked": "2026-10-23T15:02:04.936815+00:00", "vendor_fixed": false, "pinned": false}, {"id": "CVE-2026-102786", "publisher": "Joomla! Project", "title": "Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Ph", "summary": "Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5", "cvss": 8.6, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T15:17:22.807", "modified": "2026-10-23T19:57:42.660", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-102786"}], "cwe": ["CWE-79"], "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "A"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 30, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "vendors": [], "vendors_checked": "2026-10-23T14:52:14.700663+00:00", "vendor_fixed": false, "pinned": false}, {"id": "CVE-2026-93640", "publisher": "Rapid7, Inc.", "title": "A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS", "summary": "A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wrapper forwards them to Unbound without restricting the configuration path. An attacker can supply a configuration that retains root privileges and disables the chroot. Include directives exp", "cvss": 7.8, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T14:17:57.757", "modified": "2026-10-24T04:18:27.440", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-93640"}], "cwe": ["CWE-732"], "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "L", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 27, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "vendors": [], "vendors_checked": "2026-10-23T16:03:38.207858+00:00", "vendor_fixed": false, "pinned": false}, {"id": "CVE-2026-93639", "publisher": "Rapid7, Inc.", "title": "A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator wit", "summary": "A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration can also add an attacker-controlled domain to the proxy allowlist of the default class of service. If a signed-in user in that class opens a crafted /service/proxy URL, Zimbra serves attacker-controlled H", "cvss": 8.7, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T14:17:57.640", "modified": "2026-10-23T16:44:17.950", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-93639"}], "cwe": ["CWE-862"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 30, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "vendors": [], "vendors_checked": "2026-10-23T16:02:19.453775+00:00", "vendor_fixed": false, "pinned": false}, {"id": "CVE-2026-93638", "publisher": "Rapid7, Inc.", "title": "A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an", "summary": "A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that inserts the parameter into a hidden input attribute without HTML encoding. A victim who opens the URL receives attacker-controlled script and page content under the legitimate Zimbra origin, allo", "cvss": 6.1, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T14:17:57.517", "modified": "2026-10-23T16:44:17.950", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-93638"}], "cwe": ["CWE-79"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 21, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-93636", "publisher": "Rapid7, Inc.", "title": "An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to que", "summary": "An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwise unreturned attributes of calendar resources through SearchCalendarResourcesRequest. Zimbra escapes search values but inserts the supplied attribute names directly into LDAP filter expressions without validation. An attacker can inject additional conditions and use repeated matching queries to recover readable resource attribu", "cvss": 4.3, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T14:17:57.397", "modified": "2026-10-23T16:44:17.950", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-93636"}], "cwe": ["CWE-90"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 15, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-93634", "publisher": "Rapid7, Inc.", "title": "A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user t", "summary": "A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbox through FileSharedWithMeRequest. The request bypasses delegated-account authorization and accepts attacker-selected file metadata, owner identifiers and declared sizes without validating a corresponding document share. An attacker can plant entries attributed to another real ", "cvss": 4.3, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T14:17:57.263", "modified": "2026-10-23T16:44:17.950", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-93634"}], "cwe": ["CWE-639"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 15, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-93633", "publisher": "Rapid7, Inc.", "title": "A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefca", "summary": "A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content under the Zimbra origin. When processing a stylesheet containing non-ASCII characters, DefangFilter appends the final ASCII segment without sanitizing it. HTML stored as application/x-zimbra-doc can therefore retain CSS URL references that the normal sanitizer remov", "cvss": 5.4, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T14:17:57.143", "modified": "2026-10-23T16:44:17.950", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-93633"}], "cwe": ["CWE-79"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 19, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-93631", "publisher": "Rapid7, Inc.", "title": "A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network ", "summary": "A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating Zimbra session and instead selects the destination mailbox from the browser's current authentication cookie. On a deployment with the provider configured", "cvss": 7.1, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T14:17:57.023", "modified": "2026-10-23T16:44:17.950", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-93631"}], "cwe": ["CWE-352"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 25, "tier": "P3", "why": ["High severity"], "fix": false, "watched": false, "vendors": [], "vendors_checked": "2026-10-23T16:03:38.207858+00:00", "vendor_fixed": false, "pinned": false}, {"id": "CVE-2026-93630", "publisher": "Rapid7, Inc.", "title": "A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) all", "summary": "A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on forms that target the Zimbra host. DefangFilter and the OWASP ActionAttributePolicy compare the form-action hostname with the request hostname before browser URL canonicalization. A percent-encoded hostname can therefore survive sanitization while the browser submits the form to t", "cvss": 4.3, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T14:17:56.903", "modified": "2026-10-23T16:44:17.950", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-93630"}], "cwe": ["CWE-180"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "R"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 15, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-93629", "publisher": "Rapid7, Inc.", "title": "An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email ", "summary": "An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to insert calendar invitations attributed to another user. The email delivery path permits external invitations but does not verify that the message sender is authorized to use the iCalendar ORGANIZER identity. When automatic invitation insertion is enabled, a crafted REQUEST component creates an event containing attacker-selected ", "cvss": 5.3, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T14:17:56.787", "modified": "2026-10-23T16:44:17.950", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-93629"}], "cwe": ["CWE-290"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 24, "tier": "P3", "why": ["Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-93628", "publisher": "Rapid7, Inc.", "title": "An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) ", "summary": "An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to forge another attendee's response to an existing meeting. Zimbra passes a null sender identity when processing iCalendar REPLY components, causing the attendee authorization filter to be skipped. An attacker who knows the meeting UID, organizer address and attendee address can send a non-outdated reply ", "cvss": 5.3, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T14:17:56.667", "modified": "2026-10-23T16:44:17.950", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-93628"}], "cwe": ["CWE-290"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 24, "tier": "P3", "why": ["Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-93627", "publisher": "Rapid7, Inc.", "title": "An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS)", "summary": "An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to cancel or modify an existing meeting in a recipient's calendar. Zimbra accepts iCalendar CANCEL and REQUEST components without verifying that the email sender is authorized to act as the supplied organizer. An attacker who knows the meeting UID and organizer address can supply a non-outdated sequence n", "cvss": 5.3, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T14:17:56.547", "modified": "2026-10-23T16:44:17.950", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-93627"}], "cwe": ["CWE-290"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 24, "tier": "P3", "why": ["Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-57208", "publisher": "GitHub, Inc.", "title": "Entire CLI hooks into Git workflows to capture AI agent sessions", "summary": "Entire CLI hooks into Git workflows to capture AI agent sessions. Prior to version 0.7.7, a path traversal vulnerability in Entire CLI allows an attacker with push access to the checkpoints repository to craft malicious checkpoint metadata that causes entire session resume or entire checkpoint rewind to write attacker-controlled transcript data outside of the expected session directory. The issue occurs because checkpoint metadata is fetched from", "cvss": 6.2, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T14:17:56.370", "modified": "2026-10-23T19:57:42.660", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-57208"}], "cwe": ["CWE-22", "CWE-73"], "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "A"}, "remote": false, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 22, "tier": "P3", "why": [], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-57207", "publisher": "GitHub, Inc.", "title": "NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox", "summary": "NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running with TRANSPORT=http, the MCP server has no authentication on the HTTP endpoint. Any client that can reach the port gets a valid MCP session and full access to all four NetBox tools - no token or credential needed. This issue has been patched in version 1.2.1.", "cvss": 5.9, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T14:17:56.197", "modified": "2026-10-23T19:57:42.660", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-57207"}], "cwe": ["CWE-306", "CWE-1059"], "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 26, "tier": "P3", "why": ["Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-55826", "publisher": "GitHub, Inc.", "title": "The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites", "summary": "The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data \u2014 including personally identifiable information (PII) \u2014 into the page's JavaScript dataLayer. This issue has been patched in version 2.1.48.", "cvss": 8.7, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T14:17:54.017", "modified": "2026-10-23T19:57:42.660", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-55826"}], "cwe": ["CWE-200"], "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 35, "tier": "P3", "why": ["High severity", "Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "vendors": [], "vendors_checked": "2026-10-23T15:02:04.936815+00:00", "vendor_fixed": false, "pinned": false}, {"id": "CVE-2026-55606", "publisher": "GitHub, Inc.", "title": "odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt", "summary": "odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size parameter. On little-endian hosts, this causes memcmp() to read far beyond the stack buffer \u2014 a single unauthenticated DHCPv6 packet triggers a 2560-byte overread from a 128-byte buffer. At time of publication, there", "cvss": 6.5, "sev": "MEDIUM", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T14:17:53.850", "modified": "2026-10-23T19:37:11.060", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-55606"}], "cwe": ["CWE-126"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 28, "tier": "P3", "why": ["Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "pinned": false}, {"id": "CVE-2026-53921", "publisher": "GitHub, Inc.", "title": "odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt", "summary": "odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on Ope", "cvss": 9.8, "sev": "CRITICAL", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T14:17:53.710", "modified": "2026-10-23T19:37:11.060", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-53921"}], "cwe": ["CWE-121"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 39, "tier": "P2", "why": ["Critical severity", "Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "vendors": [], "vendors_checked": "2026-10-23T15:56:15.313695+00:00", "vendor_fixed": false, "pinned": false}, {"id": "CVE-2026-53920", "publisher": "GitHub, Inc.", "title": "odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt", "summary": "odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header to that full structure, and reads ia->iaid before proving that the IA body contains the IAID field. If an unauthenticated network-adjacent client places a zero-length or otherwise short IA op", "cvss": 8.7, "sev": "HIGH", "epss": null, "kev": false, "added": "2026-10-23", "pub": "2026-10-23T14:17:53.573", "modified": "2026-10-23T21:17:23.897", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-53920"}], "cwe": ["CWE-125", "CWE-126", "CWE-200", "CWE-201"], "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 35, "tier": "P3", "why": ["High severity", "Remotely exploitable, no login, no user action"], "fix": false, "watched": false, "vendors": [], "vendors_checked": "2026-10-23T15:58:45.374202+00:00", "vendor_fixed": false, "pinned": false}, {"id": "CVE-2026-110063", "publisher": "Microsoft Corporation", "title": "Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allo", "summary": "Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.", "cvss": 10.0, "sev": "CRITICAL", "epss": 0.00888, "kev": false, "added": "2026-10-22", "pub": "2026-10-22T22:18:00.750", "modified": "2026-10-23T19:43:46.190", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-110063"}], "cwe": ["CWE-59"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 63, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.58949, "vendors": [{"os": "Fedora 46", "pkg": "python-streamlink", "status": "fixed", "fixed": "8.6.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-a56fcfdc08", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-a56fcfdc08", "note": "FEDORA-2026-a56fcfdc08"}, {"os": "Fedora ELN", "pkg": "valgrind", "status": "fixed", "fixed": "3.28.0-1.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-c593ef1d15", "note": "FEDORA-2026-c593ef1d15"}], "vendors_checked": "2026-10-24T06:05:19.655601+00:00", "vendor_fixed": true, "pocs": [], "mentions": [{"src": "Microsoft MSRC Update Guide", "group": "vendor", "title": "CVE-2026-110063 VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110063", "date": "2026-10-22"}], "buzz": 1, "pinned": false, "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}}, {"id": "CVE-2026-114625", "publisher": "Arista Networks, Inc.", "title": "Arista VeloCloud Orchestrator SQL Injection Vulnerability", "summary": "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\n\nOn an affected system, any authenticated user can gain operator privileges and masquerade as a local \"superuser operator\" user. Thi", "cvss": 9.9, "sev": "CRITICAL", "epss": 0.00555, "kev": true, "added": "2026-10-22", "pub": "2026-10-22T21:17:16.870", "modified": "2026-10-24T04:18:17.510", "products": [{"name": "velocloud orchestrator", "vendor": "arista", "type": "app", "affected": [">= 5.2.0 and < 5.2.3.18", ">= 6.1.0 and < 6.1.3.10", ">= 6.4.0 and < 6.4.2.12"], "fixed": "5.2.3.18, 6.1.3.10, 6.4.2.12", "safe": "before 5.2.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy velocloud-orchestrator || rpm -q velocloud-orchestrator || velocloud-orchestrator --version"}, {"label": "2. UPGRADE to 5.2.3.18 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade velocloud-orchestrator"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade velocloud-orchestrator"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 5.2.0 (Debian / Ubuntu)", "cmd": "apt-cache madison velocloud-orchestrator\nsudo apt install velocloud-orchestrator=<VERSION_BEFORE_5.2.0>\nsudo apt-mark hold velocloud-orchestrator"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list velocloud-orchestrator\nsudo dnf downgrade velocloud-orchestrator-<VERSION_BEFORE_5.2.0>\nsudo dnf versionlock add velocloud-orchestrator"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-114625"}, {"t": "Mitigation, Vendor Advisory", "u": "https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199"}], "cwe": ["CWE-89"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": "2026-10-26", "kev_added": "2026-10-23", "ransom": false, "priority": 74, "tier": "P0", "why": ["Critical severity", "Exploited in the wild (CISA KEV)", "Covered by 3 security sources"], "fix": true, "watched": false, "epss_pct": 0.45586, "vendors": [{"os": "Fedora 46", "pkg": "python-streamlink", "status": "fixed", "fixed": "8.6.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-a56fcfdc08", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-a56fcfdc08", "note": "FEDORA-2026-a56fcfdc08"}, {"os": "Fedora ELN", "pkg": "valgrind", "status": "fixed", "fixed": "3.28.0-1.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-c593ef1d15", "note": "FEDORA-2026-c593ef1d15"}], "vendors_checked": "2026-10-24T06:05:19.655601+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "mentions": [{"src": "Security Affairs", "group": "news", "title": "U.S. CISA adds Arista VeloCloud Orchestrator\u00a0flaw to its Known Exploited Vulnerabilities catalog", "url": "https://securityaffairs.com/201609/hacking/u-s-cisa-adds-arista-velocloud-orchestrator-flaw-to-its-known-exploited-vulnerabilities-catalog.html", "date": "2026-10-24"}, {"src": "CISA Alerts and Advisories", "group": "gov", "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog", "date": "2026-10-23"}, {"src": "Canadian Cyber Centre", "group": "gov", "title": "Arista Networks security advisory (AV26-1080) \u2013 Update 1", "url": "https://cyber.gc.ca/en/alerts-advisories/arista-networks-security-advisory-av26-1080", "date": "2026-10-23"}], "buzz": 3, "pinned": false}, {"id": "CVE-2021-48014", "publisher": "VulnCheck", "title": "FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operatio", "summary": "FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a __CONTENT__ payload to write a JSP webshell and achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-1", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.01669, "kev": false, "added": "2026-10-22", "pub": "2026-10-22T11:17:04.390", "modified": "2026-10-23T22:16:51.227", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2021-48014"}], "cwe": ["CWE-22"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 64, "tier": "P1", "why": ["Critical severity", "CISA SSVC: public proof of concept", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.76617, "vendors": [{"os": "Fedora 46", "pkg": "python-streamlink", "status": "fixed", "fixed": "8.6.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-a56fcfdc08", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-a56fcfdc08", "note": "FEDORA-2026-a56fcfdc08"}, {"os": "Fedora ELN", "pkg": "valgrind", "status": "fixed", "fixed": "3.28.0-1.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-c593ef1d15", "note": "FEDORA-2026-c593ef1d15"}], "vendors_checked": "2026-10-24T06:05:19.655601+00:00", "vendor_fixed": true, "pocs": [], "pinned": false, "ssvc": {"exploitation": "poc", "automatable": "yes", "impact": "total"}}, {"id": "CVE-2026-109619", "publisher": "PHP Group", "title": "PHP has various global state that temporarily points into request memory", "summary": "PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).", "cvss": 8.1, "sev": "HIGH", "epss": 0.05991, "kev": false, "added": "2026-10-21", "pub": "2026-10-21T14:17:09.823", "modified": "2026-10-23T16:06:48.917", "products": [{"name": "php", "vendor": "php", "type": "app", "affected": [">= 5.4.0 and < 8.2.35", ">= 8.3.0 and < 8.3.36", ">= 8.4.0 and < 8.4.27", ">= 8.5.0 and < 8.5.12"], "fixed": "8.2.35, 8.3.36, 8.4.27, 8.5.12", "safe": "before 5.4.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy php || rpm -q php || php --version"}, {"label": "2. UPGRADE to 8.2.35 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade php"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade php"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 5.4.0 (Debian / Ubuntu)", "cmd": "apt-cache madison php\nsudo apt install php=<VERSION_BEFORE_5.4.0>\nsudo apt-mark hold php"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list php\nsudo dnf downgrade php-<VERSION_BEFORE_5.4.0>\nsudo dnf versionlock add php"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "ruggedcom ape1808 firmware", "vendor": "siemens", "type": "os", "affected": ["all versions"], "fixed": null, "safe": null, "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "pan-os", "vendor": "paloaltonetworks", "type": "os", "affected": [">= 10.2.0 and < 10.2.7", "10.2.7", "10.2.7 h1", "10.2.7 h10", "10.2.7 h11", "10.2.7 h12", "10.2.7 h13", "10.2.7 h14"], "fixed": "10.2.7, 11.1.4, 11.2.4, 12.1.4, 12.2.4", "safe": "before 10.2.0", "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "panorama virtual appliance", "vendor": "paloaltonetworks", "type": "app", "affected": ["all versions"], "fixed": null, "safe": null, "action": "mitigate", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy panorama-virtual-appliance || rpm -q panorama-virtual-appliance || panorama-virtual-appliance --version"}, {"label": "No fixed or unaffected release known", "cmd": "Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-109619"}, {"t": "Mitigation, Vendor Advisory", "u": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"}], "cwe": ["CWE-416", "CWE-755", "CWE-824", "CWE-1325"], "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": null, "kev_added": null, "ransom": false, "priority": 65, "tier": "P1", "why": ["High severity", "EPSS top 7%: very likely to be exploited", "Public exploit reference", "Covered by 11 security sources", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.933, "vendors": [{"os": "Fedora 46", "pkg": "python-openslide", "status": "fixed", "fixed": "1.4.7-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-336bea884e", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-336bea884e", "note": "FEDORA-2026-336bea884e"}, {"os": "Fedora ELN", "pkg": "valgrind", "status": "fixed", "fixed": "3.28.0-1.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-c593ef1d15", "note": "FEDORA-2026-c593ef1d15"}, {"os": "Ubuntu 20.04", "pkg": "php7.4", "status": "fixed", "fixed": "7.4.3-4ubuntu2.29+esm5", "cmd": "sudo apt update && sudo apt install --only-upgrade php7.4\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' php7.4)\" ge \"7.4.3-4ubuntu2.29+esm5\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Ubuntu 22.04", "pkg": "php8.1", "status": "fixed", "fixed": "8.1.2-1ubuntu2.28", "cmd": "sudo apt update && sudo apt install --only-upgrade php8.1\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' php8.1)\" ge \"8.1.2-1ubuntu2.28\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Ubuntu 24.04", "pkg": "php8.3", "status": "fixed", "fixed": "8.3.6-0ubuntu0.24.04.13", "cmd": "sudo apt update && sudo apt install --only-upgrade php8.3\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' php8.3)\" ge \"8.3.6-0ubuntu0.24.04.13\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Debian 12", "pkg": "php8.2", "status": "fixed", "fixed": "8.2.35-1~deb12u1", "cmd": "sudo apt update && sudo apt install --only-upgrade php8.2\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' php8.2)\" ge \"8.2.35-1~deb12u1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Debian 13", "pkg": "php8.4", "status": "fixed", "fixed": "8.4.27-1~deb13u1", "cmd": "sudo apt update && sudo apt install --only-upgrade php8.4\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' php8.4)\" ge \"8.4.27-1~deb13u1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "RHEL 10", "pkg": "php", "status": "fixed", "fixed": "php-8.3.36-1.el10_2", "cmd": "sudo dnf upgrade --advisory=RHSA-2026:87070\nrpm -q php", "url": null, "note": null}, {"os": "RHEL 10", "pkg": "php8.4", "status": "fixed", "fixed": "php8.4-8.4.27-1.el10_2", "cmd": "sudo dnf upgrade --advisory=RHSA-2026:87071\nrpm -q php8.4", "url": null, "note": null}, {"os": "RHEL 10.0 Extended Update Support", "pkg": "php", "status": "fixed", "fixed": "php-8.3.19-1.el10_0.2", "cmd": "sudo dnf upgrade --advisory=RHSA-2026:88561\nrpm -q php", "url": null, "note": null}, {"os": "RHEL 7 Extended Lifecycle Support", "pkg": "php", "status": "fixed", "fixed": "php-5.4.16-48.el7_9.1", "cmd": "sudo dnf upgrade --advisory=RHSA-2026:88693\nrpm -q php", "url": null, "note": null}, {"os": "RHEL 9", "pkg": "php", "status": "fixed", "fixed": "php-8.0.30-8.el9_8.1", "cmd": "sudo dnf upgrade --advisory=RHSA-2026:87151\nrpm -q php", "url": null, "note": null}, {"os": "Alpine 3.21", "pkg": "php82", "status": "fixed", "fixed": "php82-8.2.35-r0", "cmd": "apk add --upgrade php82\napk info -v php82", "url": null, "note": null}, {"os": "Alpine 3.22", "pkg": "php82", "status": "fixed", "fixed": "php82-8.2.35-r0", "cmd": "apk add --upgrade php82\napk info -v php82", "url": null, "note": null}, {"os": "Alpine 3.22", "pkg": "php83", "status": "fixed", "fixed": "php83-8.3.36-r0", "cmd": "apk add --upgrade php83\napk info -v php83", "url": null, "note": null}, {"os": "Alpine 3.22", "pkg": "php84", "status": "fixed", "fixed": "php84-8.4.27-r0", "cmd": "apk add --upgrade php84\napk info -v php84", "url": null, "note": null}, {"os": "Amazon Linux 2023", "pkg": "see advisory", "status": "fixed", "fixed": null, "cmd": "sudo dnf update --advisory=ALAS2023-2026-3304", "url": "https://alas.aws.amazon.com/cve/html/CVE-2026-109619.html", "note": "ALAS2023-2026-3304"}], "vendors_checked": "2026-10-24T04:31:13.918852+00:00", "vendor_fixed": true, "mentions": [{"src": "Palo Alto Networks", "group": "vendor", "title": "CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products  (Severity: HIGH", "url": "https://security.paloaltonetworks.com/CVE-2026-109618", "date": "2026-10-24"}, {"src": "Canadian Cyber Centre", "group": "gov", "title": "AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 1", "url": "https://cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619", "date": "2026-10-23"}, {"src": "Cisco Security Advisories", "group": "vendor", "title": "Vulnerabilities in PHP Affecting Cisco Products: October 2026", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Vulnerabilities%20in%20PHP%20Affecting%20Cisco%20Products:%20October%202026%26vs_k=1", "date": "2026-10-23"}, {"src": "Siemens ProductCERT", "group": "vendor", "title": "SSA-566435 V1.0: PHP2Shell Vulnerabilities in Siemens Software Products", "url": "https://cert-portal.siemens.com/productcert/html/ssa-566435.html", "date": "2026-10-23"}, {"src": "Unit 42 (Palo Alto)", "group": "research", "title": "Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 23)", "url": "https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/", "date": "2026-10-23"}, {"src": "Horizon3.ai", "group": "research", "title": "CVE-2026-109618 / CVE-2026-109619 | NodeZero Rapid Response Check Now Available", "url": "https://horizon3.ai/attack-research/vulnerabilities/cve-2026-109618-cve-2026-109619/", "date": "2026-10-23"}, {"src": "The Hacker News", "group": "news", "title": "PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware", "url": "https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html", "date": "2026-10-23"}, {"src": "Security Affairs", "group": "news", "title": "PHP2Shell: Millions of Attacks, No Confirmed Successful Exploits Yet", "url": "https://securityaffairs.com/201538/hacking/php2shell-millions-of-attacks-no-confirmed-successful-exploits-yet.html", "date": "2026-10-23"}, {"src": "CERT/CC Vulnerability Notes", "group": "gov", "title": "VU#763488: Memory corruption vulnerabilities in PHP", "url": "https://kb.cert.org/vuls/id/763488", "date": "2026-10-22"}, {"src": "HKCERT", "group": "gov", "title": "PHP Multiple Vulnerabilities", "url": "https://www.hkcert.org/security-bulletin/php-multiple-vulnerabilities_20261022", "date": "2026-10-22"}, {"src": "Amazon Linux 2023 ALAS", "group": "distro", "title": "ALAS2023-2026-3301 (important): php8.2", "url": "https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3301.html", "date": "2026-10-22"}, {"src": "Amazon Linux 2023 ALAS", "group": "distro", "title": "ALAS2023-2026-3302 (important): php8.3", "url": "https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3302.html", "date": "2026-10-22"}, {"src": "Amazon Linux 2023 ALAS", "group": "distro", "title": "ALAS2023-2026-3303 (important): php8.4", "url": "https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3303.html", "date": "2026-10-22"}, {"src": "Amazon Linux 2023 ALAS", "group": "distro", "title": "ALAS2023-2026-3304 (important): php8.5", "url": "https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3304.html", "date": "2026-10-22"}], "buzz": 11, "pinned": false, "pocs": [{"kind": "poc", "name": "aarsaputra/php2shell (15 stars)", "url": "https://github.com/aarsaputra/php2shell", "stars": 15}, {"kind": "poc", "name": "unlimit0118/CVE-2026-109619-php2shell-poc (4 stars)", "url": "https://github.com/unlimit0118/CVE-2026-109619-php2shell-poc", "stars": 4}, {"kind": "poc", "name": "cozybear-dev/cve-2026-109619 (4 stars)", "url": "https://github.com/cozybear-dev/cve-2026-109619", "stars": 4}], "ssvc": {"exploitation": "none", "automatable": "no", "impact": "total"}}, {"id": "CVE-2026-109618", "publisher": "PHP Group", "title": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the reques", "summary": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.1162, "kev": false, "added": "2026-10-21", "pub": "2026-10-21T14:17:09.357", "modified": "2026-10-23T16:26:54.713", "products": [{"name": "php", "vendor": "php", "type": "app", "affected": [">= 7.3.0 and < 8.2.35", ">= 8.3.0 and < 8.3.36", ">= 8.4.0 and < 8.4.27", ">= 8.5.0 and < 8.5.12"], "fixed": "8.2.35, 8.3.36, 8.4.27, 8.5.12", "safe": "before 7.3.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy php || rpm -q php || php --version"}, {"label": "2. UPGRADE to 8.2.35 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade php"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade php"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 7.3.0 (Debian / Ubuntu)", "cmd": "apt-cache madison php\nsudo apt install php=<VERSION_BEFORE_7.3.0>\nsudo apt-mark hold php"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list php\nsudo dnf downgrade php-<VERSION_BEFORE_7.3.0>\nsudo dnf versionlock add php"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "ruggedcom ape1808 firmware", "vendor": "siemens", "type": "os", "affected": ["all versions"], "fixed": null, "safe": null, "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "pan-os", "vendor": "paloaltonetworks", "type": "os", "affected": [">= 10.2.0 and < 10.2.7", "10.2.7", "10.2.7 h1", "10.2.7 h10", "10.2.7 h11", "10.2.7 h12", "10.2.7 h13", "10.2.7 h14"], "fixed": "10.2.7, 11.1.4, 11.2.4, 12.1.4, 12.2.4", "safe": "before 10.2.0", "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "panorama virtual appliance", "vendor": "paloaltonetworks", "type": "app", "affected": ["all versions"], "fixed": null, "safe": null, "action": "mitigate", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy panorama-virtual-appliance || rpm -q panorama-virtual-appliance || panorama-virtual-appliance --version"}, {"label": "No fixed or unaffected release known", "cmd": "Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-109618"}, {"t": "Mitigation, Vendor Advisory", "u": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"}], "cwe": ["CWE-416", "CWE-755", "CWE-824", "CWE-1325"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": null, "kev_added": null, "ransom": false, "priority": 71, "tier": "P1", "why": ["Critical severity", "EPSS top 4%: very likely to be exploited", "Public exploit reference", "Covered by 11 security sources", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.96047, "vendors": [{"os": "Fedora 46", "pkg": "python-openslide", "status": "fixed", "fixed": "1.4.7-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-336bea884e", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-336bea884e", "note": "FEDORA-2026-336bea884e"}, {"os": "Fedora ELN", "pkg": "valgrind", "status": "fixed", "fixed": "3.28.0-1.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-c593ef1d15", "note": "FEDORA-2026-c593ef1d15"}, {"os": "Ubuntu 20.04", "pkg": "php7.4", "status": "fixed", "fixed": "7.4.3-4ubuntu2.29+esm5", "cmd": "sudo apt update && sudo apt install --only-upgrade php7.4\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' php7.4)\" ge \"7.4.3-4ubuntu2.29+esm5\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Ubuntu 22.04", "pkg": "php8.1", "status": "fixed", "fixed": "8.1.2-1ubuntu2.28", "cmd": "sudo apt update && sudo apt install --only-upgrade php8.1\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' php8.1)\" ge \"8.1.2-1ubuntu2.28\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Ubuntu 24.04", "pkg": "php8.3", "status": "fixed", "fixed": "8.3.6-0ubuntu0.24.04.13", "cmd": "sudo apt update && sudo apt install --only-upgrade php8.3\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' php8.3)\" ge \"8.3.6-0ubuntu0.24.04.13\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Debian 12", "pkg": "php8.2", "status": "fixed", "fixed": "8.2.35-1~deb12u1", "cmd": "sudo apt update && sudo apt install --only-upgrade php8.2\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' php8.2)\" ge \"8.2.35-1~deb12u1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Debian 13", "pkg": "php8.4", "status": "fixed", "fixed": "8.4.27-1~deb13u1", "cmd": "sudo apt update && sudo apt install --only-upgrade php8.4\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' php8.4)\" ge \"8.4.27-1~deb13u1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "RHEL 10", "pkg": "php", "status": "fixed", "fixed": "php-8.3.36-1.el10_2", "cmd": "sudo dnf upgrade --advisory=RHSA-2026:87070\nrpm -q php", "url": null, "note": null}, {"os": "RHEL 10", "pkg": "php8.4", "status": "fixed", "fixed": "php8.4-8.4.27-1.el10_2", "cmd": "sudo dnf upgrade --advisory=RHSA-2026:87071\nrpm -q php8.4", "url": null, "note": null}, {"os": "RHEL 10.0 Extended Update Support", "pkg": "php", "status": "fixed", "fixed": "php-8.3.19-1.el10_0.2", "cmd": "sudo dnf upgrade --advisory=RHSA-2026:88561\nrpm -q php", "url": null, "note": null}, {"os": "RHEL 9", "pkg": "php", "status": "fixed", "fixed": "php-8.0.30-8.el9_8.1", "cmd": "sudo dnf upgrade --advisory=RHSA-2026:87151\nrpm -q php", "url": null, "note": null}, {"os": "RHEL 9.2 Update Services for SAP Solutions", "pkg": "php", "status": "fixed", "fixed": "php-8.0.30-1.el9_2.2", "cmd": "sudo dnf upgrade --advisory=RHSA-2026:88659\nrpm -q php", "url": null, "note": null}, {"os": "Alpine 3.21", "pkg": "php82", "status": "fixed", "fixed": "php82-8.2.35-r0", "cmd": "apk add --upgrade php82\napk info -v php82", "url": null, "note": null}, {"os": "Alpine 3.22", "pkg": "php82", "status": "fixed", "fixed": "php82-8.2.35-r0", "cmd": "apk add --upgrade php82\napk info -v php82", "url": null, "note": null}, {"os": "Alpine 3.22", "pkg": "php83", "status": "fixed", "fixed": "php83-8.3.36-r0", "cmd": "apk add --upgrade php83\napk info -v php83", "url": null, "note": null}, {"os": "Alpine 3.22", "pkg": "php84", "status": "fixed", "fixed": "php84-8.4.27-r0", "cmd": "apk add --upgrade php84\napk info -v php84", "url": null, "note": null}, {"os": "Amazon Linux 2023", "pkg": "see advisory", "status": "fixed", "fixed": null, "cmd": "sudo dnf update --advisory=ALAS2023-2026-3304", "url": "https://alas.aws.amazon.com/cve/html/CVE-2026-109618.html", "note": "ALAS2023-2026-3304"}], "vendors_checked": "2026-10-24T04:31:13.918852+00:00", "vendor_fixed": true, "pocs": [{"kind": "poc", "name": "ikow/php2shell-poc (1698 stars)", "url": "https://github.com/ikow/php2shell-poc", "stars": 1698}, {"kind": "poc", "name": "eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC (970 stars)", "url": "https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC", "stars": 970}, {"kind": "poc", "name": "assetnote/php2shell-scanner (473 stars)", "url": "https://github.com/assetnote/php2shell-scanner", "stars": 473}, {"kind": "edb", "name": "PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE", "url": "https://www.exploit-db.com/exploits/52704"}, {"kind": "nuclei", "name": "PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Active Crash Detection", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-109618.yaml"}], "mentions": [{"src": "Palo Alto Networks", "group": "vendor", "title": "CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products  (Severity: HIGH", "url": "https://security.paloaltonetworks.com/CVE-2026-109618", "date": "2026-10-24"}, {"src": "Canadian Cyber Centre", "group": "gov", "title": "AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 1", "url": "https://cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619", "date": "2026-10-23"}, {"src": "Cisco Security Advisories", "group": "vendor", "title": "Vulnerabilities in PHP Affecting Cisco Products: October 2026", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Vulnerabilities%20in%20PHP%20Affecting%20Cisco%20Products:%20October%202026%26vs_k=1", "date": "2026-10-23"}, {"src": "Siemens ProductCERT", "group": "vendor", "title": "SSA-566435 V1.0: PHP2Shell Vulnerabilities in Siemens Software Products", "url": "https://cert-portal.siemens.com/productcert/html/ssa-566435.html", "date": "2026-10-23"}, {"src": "Siemens ProductCERT", "group": "vendor", "title": "SSA-566512 V1.0: PHP2Shell Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices", "url": "https://cert-portal.siemens.com/productcert/html/ssa-566512.html", "date": "2026-10-23"}, {"src": "Unit 42 (Palo Alto)", "group": "research", "title": "Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 23)", "url": "https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/", "date": "2026-10-23"}, {"src": "Horizon3.ai", "group": "research", "title": "CVE-2026-109618 / CVE-2026-109619 | NodeZero Rapid Response Check Now Available", "url": "https://horizon3.ai/attack-research/vulnerabilities/cve-2026-109618-cve-2026-109619/", "date": "2026-10-23"}, {"src": "The Hacker News", "group": "news", "title": "PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware", "url": "https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html", "date": "2026-10-23"}, {"src": "Security Affairs", "group": "news", "title": "PHP2Shell: Millions of Attacks, No Confirmed Successful Exploits Yet", "url": "https://securityaffairs.com/201538/hacking/php2shell-millions-of-attacks-no-confirmed-successful-exploits-yet.html", "date": "2026-10-23"}, {"src": "CERT/CC Vulnerability Notes", "group": "gov", "title": "VU#763488: Memory corruption vulnerabilities in PHP", "url": "https://kb.cert.org/vuls/id/763488", "date": "2026-10-22"}, {"src": "HKCERT", "group": "gov", "title": "PHP Multiple Vulnerabilities", "url": "https://www.hkcert.org/security-bulletin/php-multiple-vulnerabilities_20261022", "date": "2026-10-22"}, {"src": "Amazon Linux 2023 ALAS", "group": "distro", "title": "ALAS2023-2026-3301 (important): php8.2", "url": "https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3301.html", "date": "2026-10-22"}, {"src": "Amazon Linux 2023 ALAS", "group": "distro", "title": "ALAS2023-2026-3302 (important): php8.3", "url": "https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3302.html", "date": "2026-10-22"}, {"src": "Amazon Linux 2023 ALAS", "group": "distro", "title": "ALAS2023-2026-3303 (important): php8.4", "url": "https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3303.html", "date": "2026-10-22"}], "buzz": 11, "pinned": false, "ssvc": {"exploitation": "none", "automatable": "no", "impact": "total"}}, {"id": "CVE-2026-102764", "publisher": "BeyondTrust", "title": "BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability", "summary": "The vulnerability exists within internal components of BeyondTrust\u2019s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.0118, "kev": true, "added": "2026-10-15", "pub": "2026-10-15T21:17:00.117", "modified": "2026-10-17T04:16:47.117", "products": [{"name": "remote support", "vendor": "beyondtrust", "type": "app", "affected": ["<= 26.2.3"], "fixed": "newer than 26.2.3", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy remote-support || rpm -q remote-support || remote-support --version"}, {"label": "2. UPGRADE to newer than 26.2.3 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade remote-support"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade remote-support"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-102764"}, {"t": "Vendor Advisory", "u": "https://www.beyondtrust.com/blog/entry/bt26-05"}], "cwe": ["CWE-290"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": "2026-10-19", "kev_added": "2026-10-16", "ransom": false, "priority": 87, "tier": "P0", "why": ["Critical severity", "Exploited in the wild (CISA KEV)", "Covered by 7 security sources", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.67457, "pinned": false, "pocs": [{"kind": "poc", "name": "Worthes/CVE-2026-102764-Proof-of-concept (3 stars)", "url": "https://github.com/Worthes/CVE-2026-102764-Proof-of-concept", "stars": 3}, {"kind": "poc", "name": "maxprog-svg/CVE-2026-102764 (0 stars)", "url": "https://github.com/maxprog-svg/CVE-2026-102764", "stars": 0}], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true, "mentions": [{"src": "HKCERT", "group": "gov", "title": "BeyondTrust Remote Support Security Restriction Bypass Vulnerability", "url": "https://www.hkcert.org/security-bulletin/beyondtrust-remote-support-security-restriction-bypass-vulnerability_20261020", "date": "2026-10-20"}, {"src": "Rapid7 Blog", "group": "research", "title": "CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild", "url": "https://www.rapid7.com/blog/post/etr-cve-2026-102764-critical-beyondtrust-remote-support-authentication-bypass-exploited-in-the-wild", "date": "2026-10-19"}, {"src": "CISA Alerts and Advisories", "group": "gov", "title": "CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support", "url": "https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support", "date": "2026-10-16"}, {"src": "Canadian Cyber Centre", "group": "gov", "title": "BeyondTrust security advisory (AV26-1054) \u2013 Update 1", "url": "https://cyber.gc.ca/en/alerts-advisories/beyondtrust-security-advisory-av26-1054", "date": "2026-10-16"}, {"src": "Canadian Cyber Centre", "group": "gov", "title": "AL26-025 - Critical vulnerability impacting BeyondTrust Remote Support \u2013 CVE-2026-102764", "url": "https://cyber.gc.ca/en/alerts-advisories/al26-025-critical-vulnerability-impacting-beyondtrust-remote-support-cve-2026-102764", "date": "2026-10-16"}, {"src": "CERT-SE Sweden", "group": "gov", "title": "BeyondTrust varnar f\u00f6r kritisk nolldagss\u00e5rbarhet", "url": "https://www.cert.se/2026/10/beyondtrust-varnar-for-kritisk-nolldagssarbarhet.html", "date": "2026-10-16"}, {"src": "NCSC Netherlands", "group": "gov", "title": "NCSC-2026-0437 [1.00] [H/H] Kwetsbaarheid verholpen in BeyondTrust Remote Support", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0437", "date": "2026-10-16"}, {"src": "Mandiant / Google Cloud Threat Intel", "group": "research", "title": "ARMORY CASTLE Exploits BeyondTrust", "url": "https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/", "date": "2026-10-15"}], "buzz": 7}, {"id": "CVE-2026-0322", "publisher": "Palo Alto Networks, Inc.", "title": "Palo Alto Networks PAN-OS Code Injection Vulnerability", "summary": "A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS\u00ae software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.\n\n\n\nThe security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended\u00a0 best practice deployment guidelines https://live.", "cvss": 7.2, "sev": "HIGH", "epss": 0.01215, "kev": true, "added": "2026-10-14", "pub": "2026-10-14T18:17:07.743", "modified": "2026-10-15T13:47:26.713", "products": [{"name": "pan-os", "vendor": "paloaltonetworks", "type": "os", "affected": ["< 10.2.0", ">= 12.2.0 and < 12.2.4", "10.2.7", "10.2.7 h1", "10.2.7 h12", "10.2.7 h16", "10.2.7 h18", "10.2.7 h19"], "fixed": "10.2.0, 12.2.4", "safe": "before 10.2.7", "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-0322"}, {"t": "Vendor Advisory", "u": "https://security.paloaltonetworks.com/CVE-2026-0322"}], "cwe": ["CWE-94"], "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "H", "ui": "N"}, "remote": false, "exploit": false, "kev_due": "2026-10-17", "kev_added": "2026-10-14", "ransom": false, "priority": 67, "tier": "P0", "why": ["High severity", "Exploited in the wild (CISA KEV)"], "fix": true, "watched": false, "epss_pct": 0.68361, "pinned": false, "pocs": [{"kind": "poc", "name": "Ife-ella/CVE-vulnerability (0 stars)", "url": "https://github.com/Ife-ella/CVE-vulnerability", "stars": 0}], "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true, "mentions": [{"src": "Canadian Cyber Centre", "group": "gov", "title": "Palo Alto Networks security advisory (AV26-1041) - Update 1", "url": "https://cyber.gc.ca/en/alerts-advisories/palo-alto-networks-security-advisory-av26-1041", "date": "2026-10-15"}, {"src": "Palo Alto Networks", "group": "vendor", "title": "CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface (Severity: HIGH)", "url": "https://security.paloaltonetworks.com/CVE-2026-0322", "date": "2026-10-15"}], "buzz": 2}, {"id": "CVE-2026-76519", "publisher": "Cisco Systems, Inc.", "title": "Cisco Secure Email Gateway Relative Path Traversal Vulnerability", "summary": "A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.\r\n\r\nThis vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A ", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.01573, "kev": true, "added": "2026-10-14", "pub": "2026-10-14T17:19:10.747", "modified": "2026-10-15T13:47:19.470", "products": [{"name": "asyncos", "vendor": "cisco", "type": "os", "affected": [">= 15.0 and < 15.5.5-014", ">= 16.0 and < 16.5.0-780"], "fixed": "15.5.5-014, 16.5.0-780", "safe": "before 15.0", "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-76519"}, {"t": "Vendor Advisory", "u": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp"}], "cwe": ["CWE-23"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": "2026-10-17", "kev_added": "2026-10-14", "ransom": false, "priority": 89, "tier": "P0", "why": ["Critical severity", "Exploited in the wild (CISA KEV)", "Covered by 3 security sources", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.75231, "pinned": false, "pocs": [{"kind": "poc", "name": "Mickysalivan/CVE-2026-76519-Proof-of-concept (0 stars)", "url": "https://github.com/Mickysalivan/CVE-2026-76519-Proof-of-concept", "stars": 0}], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true, "mentions": [{"src": "HKCERT", "group": "gov", "title": "Cisco Secure Email Gateway Remote Code Execution Vulnerability", "url": "https://www.hkcert.org/security-bulletin/cisco-secure-email-gateway-remote-code-execution-vulnerability_20261015", "date": "2026-10-15"}, {"src": "Canadian Cyber Centre", "group": "gov", "title": "Cisco security advisory (AV26-1042) \u2013 Update 1", "url": "https://cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-1042", "date": "2026-10-14"}, {"src": "Cisco Security Advisories", "group": "vendor", "title": "Cisco Secure Email Gateway Arbitrary File Write Vulnerability", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Secure%20Email%20Gateway%20Arbitrary%20File%20Write%20Vulnerability%26vs_k=1", "date": "2026-10-14"}], "buzz": 3}, {"id": "CVE-2026-106931", "publisher": "JPCERT/CC", "title": "EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability", "summary": "SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.", "cvss": 7.8, "sev": "HIGH", "epss": 0.0117, "kev": true, "added": "2026-10-14", "pub": "2026-10-14T05:16:42.633", "modified": "2026-10-21T15:42:24.590", "products": [{"name": "siteguard", "vendor": "e-guardian", "type": "app", "affected": [">= 2.20 and < 8.00", "8.00", "8.00 update1", "8.00 update2", "8.00 update3", ">= 2.20 and < 7.00", "7.00", "7.00 update1"], "fixed": "7.00, 8.00", "safe": "before 2.20", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy siteguard || rpm -q siteguard || siteguard --version"}, {"label": "2. UPGRADE to 7.00 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade siteguard"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade siteguard"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 2.20 (Debian / Ubuntu)", "cmd": "apt-cache madison siteguard\nsudo apt install siteguard=<VERSION_BEFORE_2.20>\nsudo apt-mark hold siteguard"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list siteguard\nsudo dnf downgrade siteguard-<VERSION_BEFORE_2.20>\nsudo dnf versionlock add siteguard"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "siteguard", "vendor": "e-guardian", "type": "app", "affected": [">= 2.20 and < 8.00", "8.00", "8.00 update1", "8.00 update2", "8.00 update3", ">= 2.20 and < 7.00", "7.00", "7.00 update1"], "fixed": "7.00, 8.00", "safe": "before 2.20", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy siteguard || rpm -q siteguard || siteguard --version"}, {"label": "2. UPGRADE to 7.00 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade siteguard"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade siteguard"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 2.20 (Debian / Ubuntu)", "cmd": "apt-cache madison siteguard\nsudo apt install siteguard=<VERSION_BEFORE_2.20>\nsudo apt-mark hold siteguard"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list siteguard\nsudo dnf downgrade siteguard-<VERSION_BEFORE_2.20>\nsudo dnf versionlock add siteguard"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "siteguard", "vendor": "e-guardian", "type": "app", "affected": [">= 2.20 and < 3.10", ">= 4.10 and < 8.00", "8.00 update4"], "fixed": "3.10, 8.00", "safe": "before 2.20", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy siteguard || rpm -q siteguard || siteguard --version"}, {"label": "2. UPGRADE to 3.10 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade siteguard"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade siteguard"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 2.20 (Debian / Ubuntu)", "cmd": "apt-cache madison siteguard\nsudo apt install siteguard=<VERSION_BEFORE_2.20>\nsudo apt-mark hold siteguard"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list siteguard\nsudo dnf downgrade siteguard-<VERSION_BEFORE_2.20>\nsudo dnf versionlock add siteguard"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-106931"}, {"t": "Vendor Advisory", "u": "https://www.eg-secure.co.jp/siteguard/news/alert-202610-1"}], "cwe": ["CWE-78"], "vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "L", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": "2026-10-23", "kev_added": "2026-10-20", "ransom": false, "priority": 69, "tier": "P0", "why": ["High severity", "Exploited in the wild (CISA KEV)"], "fix": true, "watched": false, "epss_pct": 0.67173, "pinned": false, "pocs": [], "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true, "mentions": [{"src": "CISA Alerts and Advisories", "group": "gov", "title": "CISA Adds Six Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog", "date": "2026-10-20"}], "buzz": 1}, {"id": "CVE-2026-110447", "publisher": "MITRE", "title": "Collabora Online \u2013 Built-in CODE Server OS Command Injection Vulnerability", "summary": "Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CO", "cvss": 9.2, "sev": "CRITICAL", "epss": 0.01225, "kev": true, "added": "2026-10-14", "pub": "2026-10-14T03:17:20.683", "modified": "2026-10-24T04:18:17.157", "products": [{"name": "Collabora Online \u2013 Built-in CODE Server", "vendor": "Collabora", "type": "app", "affected": ["See advisory"], "fixed": null, "safe": null, "action": "mitigate", "steps": [{"label": "CISA required action", "cmd": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-110447"}], "cwe": ["CWE-78"], "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": "2026-10-26", "kev_added": "2026-10-23", "ransom": false, "priority": 82, "tier": "P0", "why": ["Critical severity", "Exploited in the wild (CISA KEV)", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.68615, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T19:49:27.273077+00:00", "vendor_fixed": true, "pocs": [{"kind": "poc", "name": "adriyansyah-mf/cve-2026-110447 (0 stars)", "url": "https://github.com/adriyansyah-mf/cve-2026-110447", "stars": 0}], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "mentions": [{"src": "The Hacker News", "group": "news", "title": "CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud", "url": "https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html", "date": "2026-10-24"}, {"src": "CISA Alerts and Advisories", "group": "gov", "title": "CISA Adds One Known Exploited Vulnerability to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0", "date": "2026-10-23"}], "buzz": 2, "pinned": false}, {"id": "CVE-2026-104252", "publisher": "GitHub, Inc.", "title": "Vitess is a database clustering system for horizontal scaling of MySQL", "summary": "Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.00885, "kev": false, "added": "2026-10-13", "pub": "2026-10-13T20:17:12.453", "modified": "2026-10-23T15:14:48.240", "products": [{"name": "vitess", "vendor": "linuxfoundation", "type": "app", "affected": ["< 23.0.5", ">= 24.0.0 and < 24.0.2"], "fixed": "23.0.5, 24.0.2", "safe": "before 24.0.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy vitess || rpm -q vitess || vitess --version"}, {"label": "2. UPGRADE to 23.0.5 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade vitess"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade vitess"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 24.0.0 (Debian / Ubuntu)", "cmd": "apt-cache madison vitess\nsudo apt install vitess=<VERSION_BEFORE_24.0.0>\nsudo apt-mark hold vitess"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list vitess\nsudo dnf downgrade vitess-<VERSION_BEFORE_24.0.0>\nsudo dnf versionlock add vitess"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-104252"}, {"t": "Patch", "u": "https://github.com/vitessio/vitess/commit/3140c1846cd120db34f33b2083139b4ab638aed2"}, {"t": "Patch", "u": "https://github.com/vitessio/vitess/commit/976e1e0d78f9d29d02e5e31b4aa7e180648f08af"}, {"t": "Patch", "u": "https://github.com/vitessio/vitess/commit/c1ed96302e658190168c971afdac730cf70e43f7"}, {"t": "Issue Tracking, Patch", "u": "https://github.com/vitessio/vitess/pull/20255"}, {"t": "Issue Tracking, Patch", "u": "https://github.com/vitessio/vitess/pull/20273"}, {"t": "Issue Tracking, Patch", "u": "https://github.com/vitessio/vitess/pull/20274"}], "cwe": ["CWE-79"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": null, "kev_added": null, "ransom": false, "priority": 64, "tier": "P1", "why": ["Critical severity", "Public exploit reference", "Remotely exploitable, no login, no user action", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.58883, "vendors": [{"os": "Go", "pkg": "vitess.io/vitess", "status": "fixed", "fixed": "0.23.5", "cmd": "go get vitess.io/vitess@v0.23.5\ngo list -m vitess.io/vitess", "url": "https://github.com/advisories/GHSA-v75v-6fpf-gvw8", "note": "vulnerable: < 0.23.5"}], "vendors_checked": "2026-10-23T15:53:30.516453+00:00", "vendor_fixed": true, "pinned": false}, {"id": "CVE-2026-96951", "publisher": "Microsoft Corporation", "title": "Microsoft Windows Command Injection Vulnerability", "summary": "Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.", "cvss": 8.8, "sev": "HIGH", "epss": 0.01512, "kev": true, "added": "2026-10-13", "pub": "2026-10-13T19:22:07.760", "modified": "2026-10-16T17:18:00.760", "products": [{"name": "outlook web", "vendor": "microsoft", "type": "app", "affected": ["all versions"], "fixed": null, "safe": null, "action": "mitigate", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy outlook-web || rpm -q outlook-web || outlook-web --version"}, {"label": "No fixed or unaffected release known", "cmd": "Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access."}]}, {"name": "windows 10 1607", "vendor": "microsoft", "type": "os", "affected": ["< 10.0.14393.9612"], "fixed": "10.0.14393.9612", "safe": null, "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "windows 10 1809", "vendor": "microsoft", "type": "os", "affected": ["< 10.0.17763.9376"], "fixed": "10.0.17763.9376", "safe": null, "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "windows 10 21h2", "vendor": "microsoft", "type": "os", "affected": ["< 10.0.19044.7807"], "fixed": "10.0.19044.7807", "safe": null, "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "windows 10 22h2", "vendor": "microsoft", "type": "os", "affected": ["< 10.0.19045.7807"], "fixed": "10.0.19045.7807", "safe": null, "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "windows 11 23h2", "vendor": "microsoft", "type": "os", "affected": ["< 10.0.22631.7652"], "fixed": "10.0.22631.7652", "safe": null, "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-96951"}, {"t": "Patch, Vendor Advisory", "u": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951"}], "cwe": ["CWE-77"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "R"}, "remote": false, "exploit": false, "kev_due": "2026-10-16", "kev_added": "2026-10-13", "ransom": false, "priority": 79, "tier": "P0", "why": ["High severity", "Exploited in the wild (CISA KEV)", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.74285, "pinned": false, "pocs": [], "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}, {"os": "Windows Server 2012 R2", "pkg": "KB5126836", "status": "fixed", "fixed": "6.3.9600.23470", "cmd": "Install KB5126836 via Windows Update, then verify:\nGet-HotFix -Id KB5126836", "url": "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5126836", "note": "KB5126836"}, {"os": "Windows Server 2012 R2 (Server Core installation)", "pkg": "KB5126836", "status": "fixed", "fixed": "6.3.9600.23470", "cmd": "Install KB5126836 via Windows Update, then verify:\nGet-HotFix -Id KB5126836", "url": "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5126836", "note": "KB5126836"}, {"os": "Windows 10 Version 1607 for 32-bit Systems", "pkg": "KB5126868", "status": "fixed", "fixed": "10.0.14393.9612", "cmd": "Install KB5126868 via Windows Update, then verify:\nGet-HotFix -Id KB5126868", "url": "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5126868", "note": "KB5126868"}, {"os": "Windows 10 Version 1607 for x64-based Systems", "pkg": "KB5126868", "status": "fixed", "fixed": "10.0.14393.9612", "cmd": "Install KB5126868 via Windows Update, then verify:\nGet-HotFix -Id KB5126868", "url": "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5126868", "note": "KB5126868"}, {"os": "Windows Server 2016", "pkg": "KB5126868", "status": "fixed", "fixed": "10.0.14393.9612", "cmd": "Install KB5126868 via Windows Update, then verify:\nGet-HotFix -Id KB5126868", "url": "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5126868", "note": "KB5126868"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true}, {"id": "CVE-2026-104935", "publisher": "ivanti", "title": "Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability", "summary": "Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.", "cvss": 8.6, "sev": "HIGH", "epss": 0.25982, "kev": true, "added": "2026-10-13", "pub": "2026-10-13T16:17:11.640", "modified": "2026-10-13T19:24:36.243", "products": [{"name": "connect secure", "vendor": "ivanti", "type": "app", "affected": [">= 25.1.0.0 and < 25.1.1.2", ">= 25.1.2.0 and < 25.1.3.0", "22.8 r2", "22.8 r2.1", "22.8 r2.2", "22.8 r2.3", "22.8 r2.4"], "fixed": "25.1.1.2, 25.1.3.0", "safe": "before 22.8", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy connect-secure || rpm -q connect-secure || connect-secure --version"}, {"label": "2. UPGRADE to 25.1.1.2 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade connect-secure"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade connect-secure"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 22.8 (Debian / Ubuntu)", "cmd": "apt-cache madison connect-secure\nsudo apt install connect-secure=<VERSION_BEFORE_22.8>\nsudo apt-mark hold connect-secure"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list connect-secure\nsudo dnf downgrade connect-secure-<VERSION_BEFORE_22.8>\nsudo dnf versionlock add connect-secure"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-104935"}, {"t": "Vendor Advisory", "u": "https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935"}], "cwe": ["CWE-290"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": "2026-10-16", "kev_added": "2026-10-13", "ransom": false, "priority": 91, "tier": "P0", "why": ["High severity", "EPSS top 2%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Covered by 4 security sources", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.97984, "pocs": [{"kind": "poc", "name": "ApexBreach/CVE-2026-104935-Proof-of-concept (1 stars)", "url": "https://github.com/ApexBreach/CVE-2026-104935-Proof-of-concept", "stars": 1}, {"kind": "poc", "name": "0x45dd/ivanti-cve-2026-104935-check (0 stars)", "url": "https://github.com/0x45dd/ivanti-cve-2026-104935-check", "stars": 0}, {"kind": "poc", "name": "maxprog-svg/CVE-2026-104935 (0 stars)", "url": "https://github.com/maxprog-svg/CVE-2026-104935", "stars": 0}, {"kind": "nuclei", "name": "Ivanti Connect Secure <= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH Header", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-104935.yaml"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true, "mentions": [{"src": "Canadian Cyber Centre", "group": "gov", "title": "Ivanti security advisory (AV26-1035) - Update 1", "url": "https://cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-1035", "date": "2026-10-16"}, {"src": "CERT-FR Alerts", "group": "gov", "title": "Vuln\u00e9rabilit\u00e9 dans Ivanti Connect Secure (ICS) (14 octobre 2026)", "url": "https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-013/", "date": "2026-10-14"}, {"src": "Dark Reading", "group": "news", "title": "Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles", "url": "https://www.darkreading.com/vulnerabilities-threats/ivanti-ics-zero-day-attacks-vendor-patching", "date": "2026-10-14"}, {"src": "Rapid7 Blog", "group": "research", "title": "Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)", "url": "https://www.rapid7.com/blog/post/etr-ivanti-connect-secure-zero-day-exploited-in-the-wild-cve-2026-104935", "date": "2026-10-13"}], "buzz": 4}, {"id": "CVE-2026-21589", "publisher": "Atlassian", "title": "Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability", "summary": "This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this v", "cvss": 7.5, "sev": "HIGH", "epss": 0.12711, "kev": true, "added": "2026-10-05", "pub": "2026-10-05T22:16:58.423", "modified": "2026-10-19T20:31:57.050", "products": [{"name": "bitbucket data center", "vendor": "atlassian", "type": "app", "affected": [">= 7.17.0 and < 9.4.26", ">= 9.5.0 and < 10.2.8", ">= 10.3.0 and < 10.5.1"], "fixed": "9.4.26, 10.2.8, 10.5.1", "safe": "before 7.17.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy bitbucket-data-center || rpm -q bitbucket-data-center || bitbucket-data-center --version"}, {"label": "2. UPGRADE to 9.4.26 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade bitbucket-data-center"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade bitbucket-data-center"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 7.17.0 (Debian / Ubuntu)", "cmd": "apt-cache madison bitbucket-data-center\nsudo apt install bitbucket-data-center=<VERSION_BEFORE_7.17.0>\nsudo apt-mark hold bitbucket-data-center"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list bitbucket-data-center\nsudo dnf downgrade bitbucket-data-center-<VERSION_BEFORE_7.17.0>\nsudo dnf versionlock add bitbucket-data-center"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "bitbucket server", "vendor": "atlassian", "type": "app", "affected": [">= 4.6.0 and <= 8.14.6"], "fixed": "newer than 8.14.6", "safe": "before 4.6.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy bitbucket-server || rpm -q bitbucket-server || bitbucket-server --version"}, {"label": "2. UPGRADE to newer than 8.14.6 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade bitbucket-server"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade bitbucket-server"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 4.6.0 (Debian / Ubuntu)", "cmd": "apt-cache madison bitbucket-server\nsudo apt install bitbucket-server=<VERSION_BEFORE_4.6.0>\nsudo apt-mark hold bitbucket-server"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list bitbucket-server\nsudo dnf downgrade bitbucket-server-<VERSION_BEFORE_4.6.0>\nsudo dnf versionlock add bitbucket-server"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "confluence data center", "vendor": "atlassian", "type": "app", "affected": [">= 5.10.0 and < 9.2.26", ">= 9.3.0 and < 10.2.19"], "fixed": "9.2.26, 10.2.19", "safe": "before 5.10.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy confluence-data-center || rpm -q confluence-data-center || confluence-data-center --version"}, {"label": "2. UPGRADE to 9.2.26 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade confluence-data-center"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade confluence-data-center"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 5.10.0 (Debian / Ubuntu)", "cmd": "apt-cache madison confluence-data-center\nsudo apt install confluence-data-center=<VERSION_BEFORE_5.10.0>\nsudo apt-mark hold confluence-data-center"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list confluence-data-center\nsudo dnf downgrade confluence-data-center-<VERSION_BEFORE_5.10.0>\nsudo dnf versionlock add confluence-data-center"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "crowd", "vendor": "atlassian", "type": "app", "affected": [">= 2.11.0 and < 6.3.7", ">= 7.0.0 and < 7.0.3", ">= 7.1.0 and < 7.1.7", ">= 7.2.0 and < 7.2.4"], "fixed": "6.3.7, 7.0.3, 7.1.7, 7.2.4", "safe": "before 2.11.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy crowd || rpm -q crowd || crowd --version"}, {"label": "2. UPGRADE to 6.3.7 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade crowd"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade crowd"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 2.11.0 (Debian / Ubuntu)", "cmd": "apt-cache madison crowd\nsudo apt install crowd=<VERSION_BEFORE_2.11.0>\nsudo apt-mark hold crowd"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list crowd\nsudo dnf downgrade crowd-<VERSION_BEFORE_2.11.0>\nsudo dnf versionlock add crowd"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "jira data center", "vendor": "atlassian", "type": "app", "affected": [">= 7.1.0 and < 9.12.40", ">= 9.13.0 and < 10.3.26", ">= 10.4.0 and < 11.3.12"], "fixed": "9.12.40, 10.3.26, 11.3.12", "safe": "before 7.1.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy jira-data-center || rpm -q jira-data-center || jira-data-center --version"}, {"label": "2. UPGRADE to 9.12.40 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade jira-data-center"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade jira-data-center"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 7.1.0 (Debian / Ubuntu)", "cmd": "apt-cache madison jira-data-center\nsudo apt install jira-data-center=<VERSION_BEFORE_7.1.0>\nsudo apt-mark hold jira-data-center"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list jira-data-center\nsudo dnf downgrade jira-data-center-<VERSION_BEFORE_7.1.0>\nsudo dnf versionlock add jira-data-center"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "jira service desk", "vendor": "atlassian", "type": "app", "affected": [">= 3.1.0 and <= 4.13.27"], "fixed": "newer than 4.13.27", "safe": "before 3.1.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy jira-service-desk || rpm -q jira-service-desk || jira-service-desk --version"}, {"label": "2. UPGRADE to newer than 4.13.27 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade jira-service-desk"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade jira-service-desk"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 3.1.0 (Debian / Ubuntu)", "cmd": "apt-cache madison jira-service-desk\nsudo apt install jira-service-desk=<VERSION_BEFORE_3.1.0>\nsudo apt-mark hold jira-service-desk"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list jira-service-desk\nsudo dnf downgrade jira-service-desk-<VERSION_BEFORE_3.1.0>\nsudo dnf versionlock add jira-service-desk"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-21589"}, {"t": "Issue Tracking, Mitigation", "u": "https://jira.atlassian.com/browse/BAM-26567"}, {"t": "Issue Tracking, Mitigation", "u": "https://jira.atlassian.com/browse/BSERV-20604"}, {"t": "Issue Tracking, Mitigation", "u": "https://jira.atlassian.com/browse/CONFSERVER-104488"}, {"t": "Issue Tracking, Mitigation", "u": "https://jira.atlassian.com/browse/CRUC-8741"}, {"t": "Issue Tracking, Mitigation", "u": "https://jira.atlassian.com/browse/CWD-6610"}, {"t": "Issue Tracking, Mitigation", "u": "https://jira.atlassian.com/browse/FE-7583"}], "cwe": ["CWE-552"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-10-18", "kev_added": "2026-10-15", "ransom": false, "priority": 88, "tier": "P0", "why": ["High severity", "EPSS top 4%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "Covered by 3 security sources", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.96263, "pocs": [{"kind": "poc", "name": "watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589 (15 stars)", "url": "https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589", "stars": 15}, {"kind": "poc", "name": "tc4dy/CVE-2026-21589-PoC-Exploit (11 stars)", "url": "https://github.com/tc4dy/CVE-2026-21589-PoC-Exploit", "stars": 11}, {"kind": "poc", "name": "MarcusProgram/CVE-2026-21589 (9 stars)", "url": "https://github.com/MarcusProgram/CVE-2026-21589", "stars": 9}, {"kind": "nuclei", "name": "Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21589.yaml"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true, "mentions": [{"src": "Canadian Cyber Centre", "group": "gov", "title": "Atlassian security advisory (AV26-1002) - Update 2", "url": "https://cyber.gc.ca/en/alerts-advisories/atlassian-security-advisory-av26-1002", "date": "2026-10-15"}, {"src": "Rapid7 Blog", "group": "research", "title": "CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products", "url": "https://www.rapid7.com/blog/post/etr-cve-2026-21589-critical-unauthenticated-arbitrary-file-access-in-atlassian-products", "date": "2026-10-07"}, {"src": "watchTowr Labs", "group": "research", "title": "You Won\u2019t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)", "url": "https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/", "date": "2026-10-06"}], "buzz": 3}, {"id": "CVE-2026-105134", "publisher": "VulDB", "title": "Ahsay AhsayCBS Command Injection Vulnerability", "summary": "A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is a", "cvss": 10.0, "sev": "CRITICAL", "epss": 0.3831, "kev": true, "added": "2026-10-04", "pub": "2026-10-04T07:16:33.480", "modified": "2026-10-15T13:47:12.400", "products": [{"name": "cloud backup suite", "vendor": "ahsay", "type": "app", "affected": ["< 10.3.4"], "fixed": "10.3.4", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy cloud-backup-suite || rpm -q cloud-backup-suite || cloud-backup-suite --version"}, {"label": "2. UPGRADE to 10.3.4 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade cloud-backup-suite"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade cloud-backup-suite"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-105134"}], "cwe": ["CWE-77", "CWE-78"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": "2026-10-17", "kev_added": "2026-10-14", "ransom": false, "priority": 93, "tier": "P0", "why": ["Critical severity", "EPSS top 1%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.98568, "pinned": false, "pocs": [{"kind": "poc", "name": "RayanAlmulhim/CVE-2026-105134-lab (0 stars)", "url": "https://github.com/RayanAlmulhim/CVE-2026-105134-lab", "stars": 0}], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true, "mentions": [{"src": "Huntress", "group": "research", "title": "Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer", "url": "https://www.huntress.com/blog/ahsaycbs-flaws-exploit", "date": "2026-10-08"}], "buzz": 1}, {"id": "CVE-2026-105133", "publisher": "VulDB", "title": "Ahsay AhsayCBS Improper Authentication Vulnerability", "summary": "A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected", "cvss": 7.3, "sev": "HIGH", "epss": 0.05794, "kev": true, "added": "2026-10-04", "pub": "2026-10-04T07:16:33.087", "modified": "2026-10-15T13:47:06.283", "products": [{"name": "cloud backup suite", "vendor": "ahsay", "type": "app", "affected": ["< 10.3.4"], "fixed": "10.3.4", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy cloud-backup-suite || rpm -q cloud-backup-suite || cloud-backup-suite --version"}, {"label": "2. UPGRADE to 10.3.4 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade cloud-backup-suite"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade cloud-backup-suite"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-105133"}], "cwe": ["CWE-287"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": "2026-10-17", "kev_added": "2026-10-14", "ransom": false, "priority": 79, "tier": "P0", "why": ["High severity", "EPSS top 7%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.93098, "pocs": [{"kind": "poc", "name": "horizon3ai/AhsayCBS-Auth-Bypass-RCE (4 stars)", "url": "https://github.com/horizon3ai/AhsayCBS-Auth-Bypass-RCE", "stars": 4}, {"kind": "nuclei", "name": "AhsayCBS - JSON API Authentication Bypass", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-105133.yaml"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "partial"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true, "mentions": [{"src": "Huntress", "group": "research", "title": "Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer", "url": "https://www.huntress.com/blog/ahsaycbs-flaws-exploit", "date": "2026-10-08"}], "buzz": 1}, {"id": "CVE-2026-88779", "publisher": "NetScaler", "title": "Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability", "summary": "Vulnerability in NetScaler ADC and NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.", "cvss": 7.5, "sev": "HIGH", "epss": 0.00592, "kev": true, "added": "2026-10-04", "pub": "2026-10-04T04:16:43.680", "modified": "2026-10-05T13:35:24.663", "products": [{"name": "netscaler application delivery controller", "vendor": "citrix", "type": "app", "affected": [">= 13.1 and < 13.1-37.282", ">= 13.1 and < 13.1-64.28", ">= 14.1 and < 14.1-73.41", ">= 14.1-66.68 and <= 14.1-73.41"], "fixed": "13.1-37.282, 13.1-64.28, 14.1-73.41", "safe": "before 13.1", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy netscaler-application-delivery-controller || rpm -q netscaler-application-delivery-controller || netscaler-application-delivery-controller --version"}, {"label": "2. UPGRADE to 13.1-37.282 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade netscaler-application-delivery-controller"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade netscaler-application-delivery-controller"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 13.1 (Debian / Ubuntu)", "cmd": "apt-cache madison netscaler-application-delivery-controller\nsudo apt install netscaler-application-delivery-controller=<VERSION_BEFORE_13.1>\nsudo apt-mark hold netscaler-application-delivery-controller"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list netscaler-application-delivery-controller\nsudo dnf downgrade netscaler-application-delivery-controller-<VERSION_BEFORE_13.1>\nsudo dnf versionlock add netscaler-application-delivery-controller"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "netscaler gateway", "vendor": "citrix", "type": "app", "affected": [">= 13.1 and < 13.1-64.28", ">= 14.1 and < 14.1-73.41"], "fixed": "13.1-64.28, 14.1-73.41", "safe": "before 13.1", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy netscaler-gateway || rpm -q netscaler-gateway || netscaler-gateway --version"}, {"label": "2. UPGRADE to 13.1-64.28 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade netscaler-gateway"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade netscaler-gateway"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 13.1 (Debian / Ubuntu)", "cmd": "apt-cache madison netscaler-gateway\nsudo apt install netscaler-gateway=<VERSION_BEFORE_13.1>\nsudo apt-mark hold netscaler-gateway"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list netscaler-gateway\nsudo dnf downgrade netscaler-gateway-<VERSION_BEFORE_13.1>\nsudo dnf versionlock add netscaler-gateway"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-88779"}, {"t": "Vendor Advisory", "u": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174"}, {"t": "Mitigation, Vendor Advisory", "u": "https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/"}], "cwe": ["CWE-119"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": "2026-10-07", "kev_added": "2026-10-04", "ransom": false, "priority": 68, "tier": "P0", "why": ["High severity", "Exploited in the wild (CISA KEV)", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.47623, "pinned": false, "pocs": [], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "partial"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true, "mentions": [{"src": "Rapid7 Blog", "group": "research", "title": "Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779", "url": "https://www.rapid7.com/blog/post/ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779", "date": "2026-10-19"}, {"src": "CERT-FR Alerts", "group": "gov", "title": "Multiples vuln\u00e9rabilit\u00e9s dans Citrix NetScaler ADC et Gateway (28 septembre 2026)", "url": "https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/", "date": "2026-09-28"}], "buzz": 2}, {"id": "CVE-2026-104286", "publisher": "Fortinet, Inc.", "title": "Fortinet FortiMail Path Traversal Vulnerability", "summary": "An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.02201, "kev": true, "added": "2026-10-01", "pub": "2026-10-01T20:17:24.010", "modified": "2026-10-07T18:17:15.240", "products": [{"name": "fortimail", "vendor": "fortinet", "type": "app", "affected": [">= 7.2.0 and <= 7.4.8", ">= 7.6.0 and <= 7.6.6", ">= 8.0.0 and <= 8.0.1"], "fixed": "newer than 8.0.1", "safe": "before 7.2.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy fortimail || rpm -q fortimail || fortimail --version"}, {"label": "2. UPGRADE to newer than 8.0.1 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade fortimail"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade fortimail"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 7.2.0 (Debian / Ubuntu)", "cmd": "apt-cache madison fortimail\nsudo apt install fortimail=<VERSION_BEFORE_7.2.0>\nsudo apt-mark hold fortimail"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list fortimail\nsudo dnf downgrade fortimail-<VERSION_BEFORE_7.2.0>\nsudo dnf versionlock add fortimail"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-104286"}, {"t": "Mitigation, Vendor Advisory", "u": "https://fortiguard.fortinet.com/psirt/FG-IR-26-175"}], "cwe": ["CWE-22"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": "2026-10-04", "kev_added": "2026-10-01", "ransom": false, "priority": 88, "tier": "P0", "why": ["Critical severity", "Exploited in the wild (CISA KEV)", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.82394, "pinned": false, "pocs": [{"kind": "poc", "name": "ShadowForge-Cyber/CVE-2026-104286-POC (0 stars)", "url": "https://github.com/ShadowForge-Cyber/CVE-2026-104286-POC", "stars": 0}, {"kind": "poc", "name": "techupdate24/fortimail-zero-day-cve-2026-104286 (0 stars)", "url": "https://github.com/techupdate24/fortimail-zero-day-cve-2026-104286", "stars": 0}, {"kind": "poc", "name": "kh20134/fortimail-cve-2026-104286-response (0 stars)", "url": "https://github.com/kh20134/fortimail-cve-2026-104286-response", "stars": 0}], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true, "mentions": [{"src": "CERT-SE Sweden", "group": "gov", "title": "Kritisk s\u00e5rbarhet i FortiMail", "url": "https://www.cert.se/2026/10/kritisk-sarbarhet-i-fortimail.html", "date": "2026-10-02"}], "buzz": 1}, {"id": "CVE-2026-102490", "publisher": "Dutch Institute for Vulnerability Disclosure", "title": "Zammad GmbH Zammad Improper Privilege Management Vulnerability", "summary": "Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owned and writable by the zammad account before dropping their identity to that account. An attacker holding that foothold could have escalated within seco", "cvss": 7.8, "sev": "HIGH", "epss": 0.0055, "kev": true, "added": "2026-09-30", "pub": "2026-09-30T17:16:40.707", "modified": "2026-10-09T14:21:05.030", "products": [{"name": "zammad", "vendor": "zammad", "type": "app", "affected": ["< 7.2.2"], "fixed": "7.2.2", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy zammad || rpm -q zammad || zammad --version"}, {"label": "2. UPGRADE to 7.2.2 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade zammad"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade zammad"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-102490"}, {"t": "Vendor Advisory", "u": "https://github.com/zammad/zammad/security/advisories/GHSA-p97w-927q-8vxq"}, {"t": "Vendor Advisory", "u": "https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490"}], "cwe": ["CWE-269"], "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "L", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": "2026-10-05", "kev_added": "2026-10-02", "ransom": false, "priority": 64, "tier": "P0", "why": ["High severity", "Exploited in the wild (CISA KEV)"], "fix": true, "watched": false, "epss_pct": 0.45264, "pinned": false, "pocs": [], "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true}, {"id": "CVE-2026-102489", "publisher": "Dutch Institute for Vulnerability Disclosure", "title": "Zammad GmbH Zammad Session Fixation Vulnerability", "summary": "Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.01255, "kev": true, "added": "2026-09-30", "pub": "2026-09-30T17:16:40.550", "modified": "2026-10-10T04:18:08.040", "products": [{"name": "zammad", "vendor": "zammad", "type": "app", "affected": [">= 6.3.0 and <= 6.5.4"], "fixed": "newer than 6.5.4", "safe": "before 6.3.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy zammad || rpm -q zammad || zammad --version"}, {"label": "2. UPGRADE to newer than 6.5.4 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade zammad"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade zammad"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 6.3.0 (Debian / Ubuntu)", "cmd": "apt-cache madison zammad\nsudo apt install zammad=<VERSION_BEFORE_6.3.0>\nsudo apt-mark hold zammad"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list zammad\nsudo dnf downgrade zammad-<VERSION_BEFORE_6.3.0>\nsudo dnf versionlock add zammad"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-102489"}, {"t": "Vendor Advisory", "u": "https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2"}, {"t": "Vendor Advisory", "u": "https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490"}], "cwe": ["CWE-384"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-10-05", "kev_added": "2026-10-02", "ransom": false, "priority": 87, "tier": "P0", "why": ["Critical severity", "Exploited in the wild (CISA KEV)", "Public exploit reference", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.69301, "pinned": false, "pocs": [{"kind": "poc", "name": "horizon3ai/CVE-2026-102489 (6 stars)", "url": "https://github.com/horizon3ai/CVE-2026-102489", "stars": 6}, {"kind": "poc", "name": "1xPwn/CVE-2026-102489 (6 stars)", "url": "https://github.com/1xPwn/CVE-2026-102489", "stars": 6}, {"kind": "poc", "name": "Hunt-Benito/the-cookie-in-the-error-message-cve-2026-102489-zammad-session-hijack-to-rce (0 stars)", "url": "https://github.com/Hunt-Benito/the-cookie-in-the-error-message-cve-2026-102489-zammad-session-hijack-to-rce", "stars": 0}], "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true}, {"id": "CVE-2026-76504", "publisher": "Cisco Systems, Inc.", "title": "Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability", "summary": "A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user.\r\n\r\nThis vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.01819, "kev": true, "added": "2026-09-30", "pub": "2026-09-30T13:17:20.247", "modified": "2026-10-03T00:16:39.140", "products": [{"name": "catalyst sd-wan manager", "vendor": "cisco", "type": "app", "affected": ["< 20.9.10.1", ">= 20.12 and < 20.12.8.2", ">= 20.15 and < 20.15.6.1", ">= 20.18 and < 20.18.4.1", ">= 26.1 and < 26.1.2.1", "26.2"], "fixed": "20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1", "safe": "before 20.12", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy catalyst-sd-wan-manager || rpm -q catalyst-sd-wan-manager || catalyst-sd-wan-manager --version"}, {"label": "2. UPGRADE to 20.9.10.1 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade catalyst-sd-wan-manager"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade catalyst-sd-wan-manager"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 20.12 (Debian / Ubuntu)", "cmd": "apt-cache madison catalyst-sd-wan-manager\nsudo apt install catalyst-sd-wan-manager=<VERSION_BEFORE_20.12>\nsudo apt-mark hold catalyst-sd-wan-manager"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list catalyst-sd-wan-manager\nsudo dnf downgrade catalyst-sd-wan-manager-<VERSION_BEFORE_20.12>\nsudo dnf versionlock add catalyst-sd-wan-manager"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-76504"}, {"t": "Mitigation, Vendor Advisory", "u": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU"}], "cwe": ["CWE-177"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": "2026-10-03", "kev_added": "2026-09-30", "ransom": false, "priority": 87, "tier": "P0", "why": ["Critical severity", "Exploited in the wild (CISA KEV)", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.78591, "pinned": false, "pocs": [{"kind": "poc", "name": "ShadowForge-Cyber/CVE-2026-76504-Proof-of-concept (2 stars)", "url": "https://github.com/ShadowForge-Cyber/CVE-2026-76504-Proof-of-concept", "stars": 2}, {"kind": "poc", "name": "pastelghost3/cve-2026-76504-nuclei (0 stars)", "url": "https://github.com/pastelghost3/cve-2026-76504-nuclei", "stars": 0}], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true, "mentions": [{"src": "Cisco Security Advisories", "group": "vendor", "title": "Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Catalyst%20SD-WAN%20Manager%20API%20Authentication%20Bypass%20Vulnerability%26vs_k=1", "date": "2026-10-02"}], "buzz": 1}, {"id": "CVE-2026-86950", "publisher": "Apple Inc.", "title": "Apple Multiple Products Out-of-Bounds Write Vulnerability", "summary": "An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.", "cvss": 8.8, "sev": "HIGH", "epss": 0.01242, "kev": true, "added": "2026-09-28", "pub": "2026-09-28T20:17:11.193", "modified": "2026-10-01T18:17:28.430", "products": [{"name": "ipados", "vendor": "apple", "type": "os", "affected": ["< 26.7.1"], "fixed": "26.7.1", "safe": null, "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "iphone os", "vendor": "apple", "type": "os", "affected": ["< 26.7.1"], "fixed": "26.7.1", "safe": null, "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "macos", "vendor": "apple", "type": "os", "affected": ["< 15.8.1", ">= 26.0 and < 26.7.1"], "fixed": "15.8.1, 26.7.1", "safe": "before 26.0", "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-86950"}, {"t": "Release Notes, Vendor Advisory", "u": "https://support.apple.com/en-us/149226"}, {"t": "Release Notes, Vendor Advisory", "u": "https://support.apple.com/en-us/149228"}, {"t": "Release Notes, Vendor Advisory", "u": "https://support.apple.com/en-us/149229"}], "cwe": ["CWE-787"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "R"}, "remote": false, "exploit": true, "kev_due": "2026-10-13", "kev_added": "2026-09-29", "ransom": false, "priority": 78, "tier": "P0", "why": ["High severity", "Exploited in the wild (CISA KEV)", "Public exploit reference"], "fix": true, "watched": false, "epss_pct": 0.68988, "pinned": false, "pocs": [{"kind": "poc", "name": "msuiche/hotcell (10 stars)", "url": "https://github.com/msuiche/hotcell", "stars": 10}, {"kind": "poc", "name": "decalage2/detect_CVE-2026-86950 (6 stars)", "url": "https://github.com/decalage2/detect_CVE-2026-86950", "stars": 6}, {"kind": "poc", "name": "34zY/CVE-2026-86950 (1 stars)", "url": "https://github.com/34zY/CVE-2026-86950", "stars": 1}], "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true}, {"id": "CVE-2026-88772", "publisher": "NetScaler", "title": "Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability", "summary": "Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23\u00a0leading to Remote Code Execution or Denial of Service", "cvss": 8.1, "sev": "HIGH", "epss": 0.05305, "kev": true, "added": "2026-09-27", "pub": "2026-09-27T17:16:56.390", "modified": "2026-09-28T12:26:47.670", "products": [{"name": "netscaler application delivery controller", "vendor": "citrix", "type": "app", "affected": [">= 13.1 and < 13.1-64.23", ">= 13.1 and < 13.1.37.279", ">= 14.1 and < 14.1-73.37", ">= 14.1-66.68 and <= 14.1-73.37"], "fixed": "13.1.37.279, 13.1-64.23, 14.1-73.37", "safe": "before 13.1", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy netscaler-application-delivery-controller || rpm -q netscaler-application-delivery-controller || netscaler-application-delivery-controller --version"}, {"label": "2. UPGRADE to 13.1.37.279 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade netscaler-application-delivery-controller"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade netscaler-application-delivery-controller"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 13.1 (Debian / Ubuntu)", "cmd": "apt-cache madison netscaler-application-delivery-controller\nsudo apt install netscaler-application-delivery-controller=<VERSION_BEFORE_13.1>\nsudo apt-mark hold netscaler-application-delivery-controller"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list netscaler-application-delivery-controller\nsudo dnf downgrade netscaler-application-delivery-controller-<VERSION_BEFORE_13.1>\nsudo dnf versionlock add netscaler-application-delivery-controller"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "netscaler gateway", "vendor": "citrix", "type": "app", "affected": [">= 13.1 and < 13.1-64.23", ">= 14.1 and < 14.1-73.37"], "fixed": "13.1-64.23, 14.1-73.37", "safe": "before 13.1", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy netscaler-gateway || rpm -q netscaler-gateway || netscaler-gateway --version"}, {"label": "2. UPGRADE to 13.1-64.23 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade netscaler-gateway"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade netscaler-gateway"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 13.1 (Debian / Ubuntu)", "cmd": "apt-cache madison netscaler-gateway\nsudo apt install netscaler-gateway=<VERSION_BEFORE_13.1>\nsudo apt-mark hold netscaler-gateway"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list netscaler-gateway\nsudo dnf downgrade netscaler-gateway-<VERSION_BEFORE_13.1>\nsudo dnf versionlock add netscaler-gateway"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-88772"}, {"t": "Vendor Advisory", "u": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778"}], "cwe": ["CWE-119"], "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-09-30", "kev_added": "2026-09-27", "ransom": false, "priority": 89, "tier": "P0", "why": ["High severity", "EPSS top 7%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "Covered by 4 security sources", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.92568, "pocs": [{"kind": "poc", "name": "murrez/CVE-2026-88772 (12 stars)", "url": "https://github.com/murrez/CVE-2026-88772", "stars": 12}, {"kind": "poc", "name": "watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88772 (11 stars)", "url": "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88772", "stars": 11}, {"kind": "poc", "name": "FollowerSeize/CVE-2026-88772-POC (0 stars)", "url": "https://github.com/FollowerSeize/CVE-2026-88772-POC", "stars": 0}, {"kind": "msf", "name": "Citrix NetScaler Unauthenticated Login Log Command Injection (CVE-2026-88771)", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/http/citrix_netscaler_cve_2026_88771.rb"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true, "mentions": [{"src": "Rapid7 Blog", "group": "research", "title": "Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779", "url": "https://www.rapid7.com/blog/post/ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779", "date": "2026-10-19"}, {"src": "Unit 42 (Palo Alto)", "group": "research", "title": "Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)", "url": "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/", "date": "2026-09-30"}, {"src": "Mandiant / Google Cloud Threat Intel", "group": "research", "title": "Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances", "url": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances/", "date": "2026-09-29"}, {"src": "watchTowr Labs", "group": "research", "title": "Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772)", "url": "https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/", "date": "2026-09-29"}], "buzz": 4}, {"id": "CVE-2026-88771", "publisher": "NetScaler", "title": "Citrix NetScaler Improper Input Validation Vulnerability", "summary": "Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to\u00a0an unauthenticated attacker to execute arbitrary commands.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.04722, "kev": true, "added": "2026-09-27", "pub": "2026-09-27T17:16:56.260", "modified": "2026-09-29T04:18:01.603", "products": [{"name": "netscaler application delivery controller", "vendor": "citrix", "type": "app", "affected": [">= 13.1 and < 13.1-64.23", ">= 13.1 and < 13.1.37.279", ">= 14.1 and < 14.1-73.37", ">= 14.1-66.68 and <= 14.1-73.37"], "fixed": "13.1.37.279, 13.1-64.23, 14.1-73.37", "safe": "before 13.1", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy netscaler-application-delivery-controller || rpm -q netscaler-application-delivery-controller || netscaler-application-delivery-controller --version"}, {"label": "2. UPGRADE to 13.1.37.279 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade netscaler-application-delivery-controller"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade netscaler-application-delivery-controller"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 13.1 (Debian / Ubuntu)", "cmd": "apt-cache madison netscaler-application-delivery-controller\nsudo apt install netscaler-application-delivery-controller=<VERSION_BEFORE_13.1>\nsudo apt-mark hold netscaler-application-delivery-controller"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list netscaler-application-delivery-controller\nsudo dnf downgrade netscaler-application-delivery-controller-<VERSION_BEFORE_13.1>\nsudo dnf versionlock add netscaler-application-delivery-controller"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "netscaler gateway", "vendor": "citrix", "type": "app", "affected": [">= 13.1 and < 13.1-64.23", ">= 14.1 and < 14.1-73.37"], "fixed": "13.1-64.23, 14.1-73.37", "safe": "before 13.1", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy netscaler-gateway || rpm -q netscaler-gateway || netscaler-gateway --version"}, {"label": "2. UPGRADE to 13.1-64.23 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade netscaler-gateway"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade netscaler-gateway"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 13.1 (Debian / Ubuntu)", "cmd": "apt-cache madison netscaler-gateway\nsudo apt install netscaler-gateway=<VERSION_BEFORE_13.1>\nsudo apt-mark hold netscaler-gateway"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list netscaler-gateway\nsudo dnf downgrade netscaler-gateway-<VERSION_BEFORE_13.1>\nsudo dnf versionlock add netscaler-gateway"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-88771"}, {"t": "Vendor Advisory", "u": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096"}], "cwe": ["CWE-20"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-09-30", "kev_added": "2026-09-27", "ransom": false, "priority": 98, "tier": "P0", "why": ["Critical severity", "EPSS top 8%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "Covered by 5 security sources", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.91805, "pocs": [{"kind": "poc", "name": "watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771 (22 stars)", "url": "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771", "stars": 22}, {"kind": "poc", "name": "ThomasPoppelgaard/netscaler-ctx697096-checker (19 stars)", "url": "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", "stars": 19}, {"kind": "poc", "name": "technion/netscaler_scanner (1 stars)", "url": "https://github.com/technion/netscaler_scanner", "stars": 1}, {"kind": "msf", "name": "Citrix NetScaler Unauthenticated Login Log Command Injection (CVE-2026-88771)", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/http/citrix_netscaler_cve_2026_88771.rb"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true, "mentions": [{"src": "Rapid7 Blog", "group": "research", "title": "Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779", "url": "https://www.rapid7.com/blog/post/ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779", "date": "2026-10-19"}, {"src": "Cloudflare Security Blog", "group": "news", "title": "Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities", "url": "https://blog.cloudflare.com/protect-your-netscaler-gateway/", "date": "2026-10-19"}, {"src": "Unit 42 (Palo Alto)", "group": "research", "title": "Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)", "url": "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/", "date": "2026-09-30"}, {"src": "Mandiant / Google Cloud Threat Intel", "group": "research", "title": "Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances", "url": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances/", "date": "2026-09-29"}, {"src": "watchTowr Labs", "group": "research", "title": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)", "url": "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", "date": "2026-09-28"}], "buzz": 5}, {"id": "CVE-2026-96656", "publisher": "Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government", "title": "Plex Media Server External Control of File Name or Path Vulnerability", "summary": "Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.", "cvss": 7.2, "sev": "HIGH", "epss": 0.00816, "kev": true, "added": "2026-09-23", "pub": "2026-09-23T17:17:23.840", "modified": "2026-10-21T13:09:18.913", "products": [{"name": "media server", "vendor": "plex", "type": "app", "affected": ["< 1.43.3.10861"], "fixed": "1.43.3.10861", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy media-server || rpm -q media-server || media-server --version"}, {"label": "2. UPGRADE to 1.43.3.10861 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade media-server"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade media-server"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-96656"}], "cwe": ["CWE-73"], "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "H", "ui": "N"}, "remote": false, "exploit": false, "kev_due": "2026-10-23", "kev_added": "2026-10-20", "ransom": false, "priority": 64, "tier": "P0", "why": ["High severity", "Exploited in the wild (CISA KEV)"], "fix": true, "watched": false, "epss_pct": 0.56677, "pinned": false, "pocs": [{"kind": "poc", "name": "a3igner/plex-codec-cache-implant (0 stars)", "url": "https://github.com/a3igner/plex-codec-cache-implant", "stars": 0}], "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true}, {"id": "CVE-2026-96654", "publisher": "Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government", "title": "Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability", "summary": "Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.", "cvss": 6.5, "sev": "MEDIUM", "epss": 0.00465, "kev": true, "added": "2026-09-23", "pub": "2026-09-23T17:17:23.517", "modified": "2026-10-21T13:09:37.607", "products": [{"name": "media server", "vendor": "plex", "type": "app", "affected": ["< 1.43.3.10861"], "fixed": "1.43.3.10861", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy media-server || rpm -q media-server || media-server --version"}, {"label": "2. UPGRADE to 1.43.3.10861 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade media-server"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade media-server"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-96654"}], "cwe": ["CWE-84"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": "2026-10-23", "kev_added": "2026-10-20", "ransom": false, "priority": 63, "tier": "P0", "why": ["Exploited in the wild (CISA KEV)", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.39325, "pinned": false, "pocs": [], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "partial"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true, "mentions": [{"src": "CISA Alerts and Advisories", "group": "gov", "title": "CISA Adds Six Known Exploited Vulnerabilities to Catalog", "url": "https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog", "date": "2026-10-20"}], "buzz": 1}, {"id": "CVE-2026-87902", "publisher": "HackerOne", "title": "WordPress Core Remote File Inclusion Vulnerability", "summary": "An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.", "cvss": 8.1, "sev": "HIGH", "epss": 0.39979, "kev": true, "added": "2026-09-22", "pub": "2026-09-22T17:17:28.310", "modified": "2026-09-28T12:20:54.040", "products": [{"name": "wordpress", "vendor": "wordpress", "type": "app", "affected": ["< 4.7.37", ">= 4.8 and < 4.8.32", ">= 4.9 and < 4.9.33", ">= 5.0 and < 5.0.29", ">= 5.1 and < 5.1.26", ">= 5.2 and < 5.2.28", ">= 5.3 and < 5.3.25", ">= 5.4 and < 5.4.23"], "fixed": "4.7.37, 4.8.32, 4.9.33, 5.0.29, 5.1.26, 5.2.28, 5.3.25, 5.4.23, 5.5.22, 5.6.21, 5.7.19, 5.8.17, 5.9.18, 6.0.16, 6.1.14, 6.2.13, 6.3.12, 6.4.12, 6.5.12, 6.6.9, 6.7.9, 6.8.10, 6.9.9, 7.0.6, 7.1.2", "safe": "before 4.8", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy wordpress || rpm -q wordpress || wordpress --version"}, {"label": "2. UPGRADE to 4.7.37 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade wordpress"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade wordpress"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 4.8 (Debian / Ubuntu)", "cmd": "apt-cache madison wordpress\nsudo apt install wordpress=<VERSION_BEFORE_4.8>\nsudo apt-mark hold wordpress"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list wordpress\nsudo dnf downgrade wordpress-<VERSION_BEFORE_4.8>\nsudo dnf versionlock add wordpress"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-87902"}, {"t": "Vendor Advisory", "u": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp"}], "cwe": ["CWE-98"], "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-09-28", "kev_added": "2026-09-25", "ransom": false, "priority": 88, "tier": "P0", "why": ["High severity", "EPSS top 1%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.98629, "pocs": [{"kind": "poc", "name": "ressl/cve-2026-87902-poc (43 stars)", "url": "https://github.com/ressl/cve-2026-87902-poc", "stars": 43}, {"kind": "poc", "name": "abraxas/CVE-2026-87902 (35 stars)", "url": "https://github.com/abraxas/CVE-2026-87902", "stars": 35}, {"kind": "poc", "name": "tc4dy/CVE-2026-87902-Toolkit (14 stars)", "url": "https://github.com/tc4dy/CVE-2026-87902-Toolkit", "stars": 14}, {"kind": "writeup", "name": "patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-aft", "url": "https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/"}, {"kind": "edb", "name": "WordPress 7.0.2 - Path Travesal", "url": "https://www.exploit-db.com/exploits/52690"}, {"kind": "nuclei", "name": "WordPress Core - PHP Template Path Traversal", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-87902.yaml"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "python-streamlink", "status": "fixed", "fixed": "8.6.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-a56fcfdc08", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-a56fcfdc08", "note": "FEDORA-2026-a56fcfdc08"}, {"os": "Fedora ELN", "pkg": "valgrind", "status": "fixed", "fixed": "3.28.0-1.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-c593ef1d15", "note": "FEDORA-2026-c593ef1d15"}, {"os": "Debian 12", "pkg": "wordpress", "status": "vulnerable", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Debian 13", "pkg": "wordpress", "status": "fixed", "fixed": "6.8.10+dfsg1-0+deb13u1", "cmd": "sudo apt update && sudo apt install --only-upgrade wordpress\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' wordpress)\" ge \"6.8.10+dfsg1-0+deb13u1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}], "vendors_checked": "2026-10-24T06:05:19.655601+00:00", "vendor_fixed": true}, {"id": "CVE-2026-94127", "publisher": "F5 Networks", "title": "F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability", "summary": "When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability.\n\nImpact:\nThis vulnerability a", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.02226, "kev": true, "added": "2026-09-22", "pub": "2026-09-22T15:17:24.313", "modified": "2026-09-23T14:32:07.910", "products": [{"name": "big-ip access policy manager", "vendor": "f5", "type": "app", "affected": [">= 17.0.0 and <= 17.1.3", ">= 17.5.0 and <= 17.5.1", "21.1.0"], "fixed": "newer than 17.5.1", "safe": "before 17.0.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy big-ip-access-policy-manager || rpm -q big-ip-access-policy-manager || big-ip-access-policy-manager --version"}, {"label": "2. UPGRADE to newer than 17.5.1 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade big-ip-access-policy-manager"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade big-ip-access-policy-manager"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 17.0.0 (Debian / Ubuntu)", "cmd": "apt-cache madison big-ip-access-policy-manager\nsudo apt install big-ip-access-policy-manager=<VERSION_BEFORE_17.0.0>\nsudo apt-mark hold big-ip-access-policy-manager"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list big-ip-access-policy-manager\nsudo dnf downgrade big-ip-access-policy-manager-<VERSION_BEFORE_17.0.0>\nsudo dnf versionlock add big-ip-access-policy-manager"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-94127"}, {"t": "Vendor Advisory", "u": "https://my.f5.com/manage/s/article/K000162605"}], "cwe": ["CWE-122"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-09-25", "kev_added": "2026-09-22", "ransom": false, "priority": 93, "tier": "P0", "why": ["Critical severity", "Exploited in the wild (CISA KEV)", "Public exploit reference", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.82601, "pinned": false, "pocs": [{"kind": "poc", "name": "watchtowrlabs/watchTowr-vs-f5-bigip-PreAuth-RCE-CVE-2026-94127 (15 stars)", "url": "https://github.com/watchtowrlabs/watchTowr-vs-f5-bigip-PreAuth-RCE-CVE-2026-94127", "stars": 15}, {"kind": "poc", "name": "FurkanKAYAPINAR/CVE-2026-94127 (0 stars)", "url": "https://github.com/FurkanKAYAPINAR/CVE-2026-94127", "stars": 0}], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true, "mentions": [{"src": "watchTowr Labs", "group": "research", "title": "Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127)", "url": "https://labs.watchtowr.com/is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127/", "date": "2026-09-23"}], "buzz": 1}, {"id": "CVE-2026-93616", "publisher": "Check Point Software Technologies Ltd.", "title": "Check Point Multiple Products Path Traversal Vulnerability", "summary": "A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.75872, "kev": true, "added": "2026-09-22", "pub": "2026-09-22T13:17:11.963", "modified": "2026-09-23T16:38:38.987", "products": [{"name": "multi-domain security management", "vendor": "checkpoint", "type": "app", "affected": [">= r80 and < r81.10", "r81.10", "r81.10 take_106", "r81.10 take_107", "r81.10 take_109", "r81.10 take_110", "r81.10 take_113", "r81.10 take_128"], "fixed": "r81.10", "safe": "before r80", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy multi-domain-security-management || rpm -q multi-domain-security-management || multi-domain-security-management --version"}, {"label": "2. UPGRADE to r81.10 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade multi-domain-security-management"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade multi-domain-security-management"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before r80 (Debian / Ubuntu)", "cmd": "apt-cache madison multi-domain-security-management\nsudo apt install multi-domain-security-management=<VERSION_BEFORE_r80>\nsudo apt-mark hold multi-domain-security-management"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list multi-domain-security-management\nsudo dnf downgrade multi-domain-security-management-<VERSION_BEFORE_r80>\nsudo dnf versionlock add multi-domain-security-management"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "quantum security management", "vendor": "checkpoint", "type": "app", "affected": [">= r80 and < r81.10", "r81.10", "r81.10 take_106", "r81.10 take_107", "r81.10 take_109", "r81.10 take_110", "r81.10 take_113", "r81.10 take_128"], "fixed": "r81.10", "safe": "before r80", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy quantum-security-management || rpm -q quantum-security-management || quantum-security-management --version"}, {"label": "2. UPGRADE to r81.10 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade quantum-security-management"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade quantum-security-management"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before r80 (Debian / Ubuntu)", "cmd": "apt-cache madison quantum-security-management\nsudo apt install quantum-security-management=<VERSION_BEFORE_r80>\nsudo apt-mark hold quantum-security-management"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list quantum-security-management\nsudo dnf downgrade quantum-security-management-<VERSION_BEFORE_r80>\nsudo dnf versionlock add quantum-security-management"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-93616"}, {"t": "Mitigation, Patch", "u": "https://support.checkpoint.com/results/sk/sk1000171"}, {"t": "Vendor Advisory", "u": "https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/"}], "cwe": ["CWE-22"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": "2026-09-25", "kev_added": "2026-09-22", "ransom": false, "priority": 92, "tier": "P0", "why": ["Critical severity", "EPSS top 1%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.99529, "pocs": [{"kind": "poc", "name": "WadesWeaponShed/CVE-2026-93616_Checks (0 stars)", "url": "https://github.com/WadesWeaponShed/CVE-2026-93616_Checks", "stars": 0}, {"kind": "poc", "name": "BishopFox/CVE-2026-93616-check (0 stars)", "url": "https://github.com/BishopFox/CVE-2026-93616-check", "stars": 0}, {"kind": "nuclei", "name": "Check Point Security Management - Unauthenticated Directory Traversal to RCE", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-93616.yaml"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true}, {"id": "CVE-2026-93952", "publisher": "Arista Networks, Inc.", "title": "Arista VeloCloud Orchestrator Improper Input Validation Vulnerability", "summary": "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\n\nHosted, including Dedicated, versions of VCO were impacted and have already been patched.", "cvss": 10.0, "sev": "CRITICAL", "epss": 0.01062, "kev": true, "added": "2026-09-22", "pub": "2026-09-22T08:16:43.047", "modified": "2026-09-23T14:32:12.417", "products": [{"name": "velocloud orchestrator", "vendor": "arista", "type": "app", "affected": [">= 5.2.0 and < 5.2.3.16", ">= 6.1.0 and <= 6.1.3.7", ">= 6.4.0 and < 6.4.2.8", ">= 7.0.0 and <= 7.0.0.2"], "fixed": "5.2.3.16, 6.4.2.8", "safe": "before 5.2.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy velocloud-orchestrator || rpm -q velocloud-orchestrator || velocloud-orchestrator --version"}, {"label": "2. UPGRADE to 5.2.3.16 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade velocloud-orchestrator"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade velocloud-orchestrator"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 5.2.0 (Debian / Ubuntu)", "cmd": "apt-cache madison velocloud-orchestrator\nsudo apt install velocloud-orchestrator=<VERSION_BEFORE_5.2.0>\nsudo apt-mark hold velocloud-orchestrator"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list velocloud-orchestrator\nsudo dnf downgrade velocloud-orchestrator-<VERSION_BEFORE_5.2.0>\nsudo dnf versionlock add velocloud-orchestrator"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-93952"}, {"t": "Mitigation, Vendor Advisory", "u": "https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183"}], "cwe": ["CWE-20"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": "2026-09-25", "kev_added": "2026-09-22", "ransom": false, "priority": 84, "tier": "P0", "why": ["Critical severity", "Exploited in the wild (CISA KEV)", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.64332, "pinned": false, "pocs": [], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true}, {"id": "CVE-2026-76460", "publisher": "Cisco Systems, Inc.", "title": "Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability", "summary": "A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.\r\n\r\nThis vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-b", "cvss": 10.0, "sev": "CRITICAL", "epss": 0.14026, "kev": true, "added": "2026-09-16", "pub": "2026-09-16T21:17:21.430", "modified": "2026-10-07T19:17:40.417", "products": [{"name": "identity services engine", "vendor": "cisco", "type": "app", "affected": ["3.1.0", "3.1.0 patch1", "3.1.0 patch10", "3.1.0 patch11", "3.1.0 patch2", "3.1.0 patch3", "3.1.0 patch4", "3.1.0 patch5"], "fixed": null, "safe": "before 3.1.0", "action": "downgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy identity-services-engine || rpm -q identity-services-engine || identity-services-engine --version"}, {"label": "2. No fixed release: DOWNGRADE to a release before 3.1.0 (Debian / Ubuntu)", "cmd": "apt-cache madison identity-services-engine\nsudo apt install identity-services-engine=<VERSION_BEFORE_3.1.0>\nsudo apt-mark hold identity-services-engine"}, {"label": "2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list identity-services-engine\nsudo dnf downgrade identity-services-engine-<VERSION_BEFORE_3.1.0>\nsudo dnf versionlock add identity-services-engine"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "identity services engine passive identity connector", "vendor": "cisco", "type": "app", "affected": ["3.1.0", "3.1.0 patch1", "3.1.0 patch10", "3.1.0 patch11", "3.1.0 patch2", "3.1.0 patch3", "3.1.0 patch4", "3.1.0 patch5"], "fixed": null, "safe": "before 3.1.0", "action": "downgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy identity-services-engine-passive-identity-connector || rpm -q identity-services-engine-passive-identity-connector || identity-services-engine-passive-identity-connector --version"}, {"label": "2. No fixed release: DOWNGRADE to a release before 3.1.0 (Debian / Ubuntu)", "cmd": "apt-cache madison identity-services-engine-passive-identity-connector\nsudo apt install identity-services-engine-passive-identity-connector=<VERSION_BEFORE_3.1.0>\nsudo apt-mark hold identity-services-engine-passive-identity-connector"}, {"label": "2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list identity-services-engine-passive-identity-connector\nsudo dnf downgrade identity-services-engine-passive-identity-connector-<VERSION_BEFORE_3.1.0>\nsudo dnf versionlock add identity-services-engine-passive-identity-connector"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-76460"}, {"t": "Mitigation, Vendor Advisory", "u": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5"}], "cwe": ["CWE-648"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": "2026-09-19", "kev_added": "2026-09-16", "ransom": false, "priority": 92, "tier": "P0", "why": ["Critical severity", "EPSS top 3%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.96555, "pocs": [{"kind": "poc", "name": "S3v3n-JG/CVE-2026-76460 (2 stars)", "url": "https://github.com/S3v3n-JG/CVE-2026-76460", "stars": 2}, {"kind": "nuclei", "name": "Cisco Identity Services Engine - ise-kong API Gateway Authentication Bypass", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-76460.yaml"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true}, {"id": "CVE-2026-58704", "publisher": "Google Devices", "title": "Google Pixel Improper Authorization Vulnerability", "summary": "In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "cvss": 8.8, "sev": "HIGH", "epss": 0.00591, "kev": true, "added": "2026-09-15", "pub": "2026-09-15T19:17:32.297", "modified": "2026-10-07T19:17:39.150", "products": [{"name": "android", "vendor": "google", "type": "os", "affected": ["all versions"], "fixed": null, "safe": null, "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-58704"}, {"t": "Vendor Advisory", "u": "https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01"}], "cwe": ["CWE-285", "CWE-693"], "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "A", "ac": "L", "pr": "N", "ui": "N"}, "remote": false, "exploit": false, "kev_due": "2026-09-19", "kev_added": "2026-09-16", "ransom": false, "priority": 68, "tier": "P0", "why": ["High severity", "Exploited in the wild (CISA KEV)"], "fix": true, "watched": false, "epss_pct": 0.4757, "pinned": false, "pocs": [], "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true}, {"id": "CVE-2026-76461", "publisher": "Cisco Systems, Inc.", "title": "Cisco Secure Email Gateway SQL Injection Vulnerability", "summary": "A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.\r\n\r\nThis vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affecte", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.29543, "kev": true, "added": "2026-09-14", "pub": "2026-09-14T17:17:51.113", "modified": "2026-09-15T12:47:32.497", "products": [{"name": "asyncos", "vendor": "cisco", "type": "os", "affected": ["< 15.5.5-014", ">= 16.0 and < 16.0.4-302", ">= 16.5 and < 16.5.0-780"], "fixed": "15.5.5-014, 16.0.4-302, 16.5.0-780", "safe": "before 16.0", "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-76461"}, {"t": "Vendor Advisory", "u": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX"}], "cwe": ["CWE-89"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": "2026-09-17", "kev_added": "2026-09-14", "ransom": false, "priority": 92, "tier": "P0", "why": ["Critical severity", "EPSS top 2%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.98191, "pinned": false, "pocs": [{"kind": "poc", "name": "0xBlackash/CVE-2026-76461 (2 stars)", "url": "https://github.com/0xBlackash/CVE-2026-76461", "stars": 2}, {"kind": "poc", "name": "S3v3n-JG/CVE-2026-76461 (1 stars)", "url": "https://github.com/S3v3n-JG/CVE-2026-76461", "stars": 1}, {"kind": "poc", "name": "HORKimhab/CVE-2026-76461 (0 stars)", "url": "https://github.com/HORKimhab/CVE-2026-76461", "stars": 0}], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true, "mentions": [{"src": "Cisco Security Advisories", "group": "vendor", "title": "Cisco Secure Email Gateway SQL Injection Vulnerability", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Secure%20Email%20Gateway%20SQL%20Injection%20Vulnerability%26vs_k=1", "date": "2026-09-17"}], "buzz": 1}, {"id": "CVE-2026-85706", "publisher": "GitLab Inc.", "title": "GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability", "summary": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.", "cvss": 10.0, "sev": "CRITICAL", "epss": 0.91951, "kev": true, "added": "2026-09-12", "pub": "2026-09-12T03:16:30.473", "modified": "2026-09-24T12:52:28.143", "products": [{"name": "gitlab", "vendor": "gitlab", "type": "app", "affected": [">= 18.7.0 and < 18.11.12", ">= 19.0.0 and < 19.0.9", ">= 19.1.0 and < 19.1.8", ">= 19.2.0 and < 19.2.6", ">= 19.3.0 and < 19.3.2"], "fixed": "18.11.12, 19.0.9, 19.1.8, 19.2.6, 19.3.2", "safe": "before 18.7.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy gitlab || rpm -q gitlab || gitlab --version"}, {"label": "2. UPGRADE to 18.11.12 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade gitlab"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade gitlab"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 18.7.0 (Debian / Ubuntu)", "cmd": "apt-cache madison gitlab\nsudo apt install gitlab=<VERSION_BEFORE_18.7.0>\nsudo apt-mark hold gitlab"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list gitlab\nsudo dnf downgrade gitlab-<VERSION_BEFORE_18.7.0>\nsudo dnf versionlock add gitlab"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-85706"}], "cwe": ["CWE-22"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-09-14", "kev_added": "2026-09-11", "ransom": false, "priority": 98, "tier": "P0", "why": ["Critical severity", "EPSS top 1%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.99821, "pocs": [{"kind": "poc", "name": "guneykabel/cve-2026-85706 (44 stars)", "url": "https://github.com/guneykabel/cve-2026-85706", "stars": 44}, {"kind": "poc", "name": "EQSTLab/CVE-2026-85706 (29 stars)", "url": "https://github.com/EQSTLab/CVE-2026-85706", "stars": 29}, {"kind": "poc", "name": "ynsmroztas/GitLabSniper (9 stars)", "url": "https://github.com/ynsmroztas/GitLabSniper", "stars": 9}, {"kind": "msf", "name": "GitLab Unauthenticated Arbitrary File Read", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/gitlab_file_read_cve_2026_85706.rb"}, {"kind": "nuclei", "name": "GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File Read", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-85706.yaml"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true, "mentions": [{"src": "GitLab Security Releases", "group": "vendor", "title": "GitLab Critical Patch Release: 19.0.9, 18.11.12", "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-0-9-released/", "date": "2026-09-23"}], "buzz": 1}, {"id": "CVE-2026-85102", "publisher": "Check Point Software Technologies Ltd.", "title": "Check Point Multiple Products Improper Certificate Validation Vulnerability", "summary": "Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.5423, "kev": true, "added": "2026-09-09", "pub": "2026-09-09T13:20:43.793", "modified": "2026-09-23T18:22:07.453", "products": [{"name": "gaia embedded", "vendor": "checkpoint", "type": "os", "affected": [">= r81.10.00 and < r81.10.17", ">= r82.00.00 and < r82.00.10", "r81.10.17", "r81.10.17 build_996004508", "r81.10.17 build_996004620", "r81.10.17 build_996004653", "r81.10.17 build_996004721", "r81.10.17 build_996004892"], "fixed": "r81.10.17, r82.00.10", "safe": "before r81.10.00", "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "gaia os", "vendor": "checkpoint", "type": "os", "affected": [">= r80 and < r81.10", "r81.10", "r81.10 take_106", "r81.10 take_107", "r81.10 take_109", "r81.10 take_110", "r81.10 take_113", "r81.10 take_128"], "fixed": "r81.10", "safe": "before r80", "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-85102"}, {"t": "Mitigation, Patch", "u": "https://support.checkpoint.com/results/sk/sk1000117"}, {"t": "Vendor Advisory", "u": "https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/"}], "cwe": ["CWE-295"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": "2026-09-25", "kev_added": "2026-09-22", "ransom": false, "priority": 92, "tier": "P0", "why": ["Critical severity", "EPSS top 1%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.9901, "pinned": false, "pocs": [{"kind": "poc", "name": "aduli198/CVE-2026-85102 (1 stars)", "url": "https://github.com/aduli198/CVE-2026-85102", "stars": 1}], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true}, {"id": "CVE-2026-87491", "publisher": "Chrome", "title": "Google Chromium V8 Out of Bounds Write Vulnerability", "summary": "Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)", "cvss": 8.8, "sev": "HIGH", "epss": 0.03142, "kev": true, "added": "2026-09-09", "pub": "2026-09-09T01:17:05.887", "modified": "2026-09-21T13:17:11.283", "products": [{"name": "chrome", "vendor": "google", "type": "app", "affected": ["< 153.0.8010.36"], "fixed": "153.0.8010.36", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy chrome || rpm -q chrome || chrome --version"}, {"label": "2. UPGRADE to 153.0.8010.36 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade chrome"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade chrome"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-87491"}, {"t": "Release Notes, Vendor Advisory", "u": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"}], "cwe": ["CWE-787"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "R"}, "remote": false, "exploit": true, "kev_due": "2026-09-23", "kev_added": "2026-09-09", "ransom": false, "priority": 83, "tier": "P0", "why": ["High severity", "Exploited in the wild (CISA KEV)", "Public exploit reference"], "fix": true, "watched": false, "epss_pct": 0.87834, "pinned": false, "pocs": [{"kind": "poc", "name": "SneakyNachos/CVE-2026-87491-and-CVE-2026-85046-the-bagel-fell-off-the-counter (5 stars)", "url": "https://github.com/SneakyNachos/CVE-2026-87491-and-CVE-2026-85046-the-bagel-fell-off-the-counter", "stars": 5}, {"kind": "writeup", "name": "issues.chromium.org/issues/543557673", "url": "https://issues.chromium.org/issues/543557673"}], "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}, {"os": "Ubuntu 22.04", "pkg": "chromium-browser", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Ubuntu 24.04", "pkg": "chromium-browser", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Debian 12", "pkg": "chromium", "status": "fixed", "fixed": "153.0.8010.52-1~deb12u1", "cmd": "sudo apt update && sudo apt install --only-upgrade chromium\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' chromium)\" ge \"153.0.8010.52-1~deb12u1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Debian 13", "pkg": "chromium", "status": "fixed", "fixed": "153.0.8010.47-2~deb13u1", "cmd": "sudo apt update && sudo apt install --only-upgrade chromium\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' chromium)\" ge \"153.0.8010.47-2~deb13u1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true}, {"id": "CVE-2026-84869", "publisher": "ConnectWise", "title": "ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability", "summary": "A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.", "cvss": 9.9, "sev": "CRITICAL", "epss": 0.00924, "kev": true, "added": "2026-09-08", "pub": "2026-09-08T20:18:51.147", "modified": "2026-09-12T04:16:42.757", "products": [{"name": "screenconnect", "vendor": "connectwise", "type": "app", "affected": ["< 26.6.5.9742"], "fixed": "26.6.5.9742", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy screenconnect || rpm -q screenconnect || screenconnect --version"}, {"label": "2. UPGRADE to 26.6.5.9742 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade screenconnect"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade screenconnect"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-84869"}, {"t": "Vendor Advisory", "u": "https://www.connectwise.com/company/trust/advisories"}, {"t": "Vendor Advisory", "u": "https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin"}], "cwe": ["CWE-269", "CWE-862"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": "2026-09-14", "kev_added": "2026-09-11", "ransom": false, "priority": 75, "tier": "P0", "why": ["Critical severity", "Exploited in the wild (CISA KEV)"], "fix": true, "watched": false, "epss_pct": 0.6008, "pinned": false, "pocs": [], "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true}, {"id": "CVE-2026-85880", "publisher": "Microsoft Corporation", "title": "Microsoft Windows Heap-Based Buffer Overflow Vulnerability", "summary": "Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.", "cvss": 7.8, "sev": "HIGH", "epss": 0.03616, "kev": true, "added": "2026-09-08", "pub": "2026-09-08T18:21:14.087", "modified": "2026-09-24T23:19:20.773", "products": [{"name": "windows 10 1607", "vendor": "microsoft", "type": "os", "affected": ["< 10.0.14393.9512"], "fixed": "10.0.14393.9512", "safe": null, "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "windows 10 1809", "vendor": "microsoft", "type": "os", "affected": ["< 10.0.17763.9245"], "fixed": "10.0.17763.9245", "safe": null, "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "windows 10 21h2", "vendor": "microsoft", "type": "os", "affected": ["< 10.0.19044.7725"], "fixed": "10.0.19044.7725", "safe": null, "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "windows 10 22h2", "vendor": "microsoft", "type": "os", "affected": ["< 10.0.19045.7725"], "fixed": "10.0.19045.7725", "safe": null, "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "windows server 2012", "vendor": "microsoft", "type": "os", "affected": ["all versions", "r2"], "fixed": null, "safe": "before r2", "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "windows server 2016", "vendor": "microsoft", "type": "os", "affected": ["< 10.0.14393.9512"], "fixed": "10.0.14393.9512", "safe": null, "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-85880"}, {"t": "Patch, Vendor Advisory", "u": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880"}], "cwe": ["CWE-122", "CWE-908"], "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "L", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": "2026-09-22", "kev_added": "2026-09-08", "ransom": false, "priority": 80, "tier": "P0", "why": ["High severity", "Exploited in the wild (CISA KEV)", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.89459, "pinned": false, "pocs": [], "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}, {"os": "Windows 10 Version 1809 for 32-bit Systems", "pkg": "KB5122876", "status": "fixed", "fixed": "10.0.17763.9245", "cmd": "Install KB5122876 via Windows Update, then verify:\nGet-HotFix -Id KB5122876", "url": "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5122876", "note": "KB5122876"}, {"os": "Windows 10 Version 1809 for x64-based Systems", "pkg": "KB5122876", "status": "fixed", "fixed": "10.0.17763.9245", "cmd": "Install KB5122876 via Windows Update, then verify:\nGet-HotFix -Id KB5122876", "url": "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5122876", "note": "KB5122876"}, {"os": "Windows Server 2019", "pkg": "KB5122876", "status": "fixed", "fixed": "10.0.17763.9245", "cmd": "Install KB5122876 via Windows Update, then verify:\nGet-HotFix -Id KB5122876", "url": "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5122876", "note": "KB5122876"}, {"os": "Windows Server 2019 (Server Core installation)", "pkg": "KB5122876", "status": "fixed", "fixed": "10.0.17763.9245", "cmd": "Install KB5122876 via Windows Update, then verify:\nGet-HotFix -Id KB5122876", "url": "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5122876", "note": "KB5122876"}, {"os": "Windows Server 2022", "pkg": "KB5122882", "status": "fixed", "fixed": "10.0.20348.5622", "cmd": "Install KB5122882 via Windows Update, then verify:\nGet-HotFix -Id KB5122882", "url": "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5122882", "note": "KB5122882"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true}, {"id": "CVE-2026-81963", "publisher": "Microsoft Corporation", "title": "Microsoft Windows Link Following Vulnerability", "summary": "Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.", "cvss": 7.8, "sev": "HIGH", "epss": 0.00393, "kev": true, "added": "2026-09-08", "pub": "2026-09-08T18:21:00.090", "modified": "2026-09-09T05:18:17.173", "products": [{"name": "windows 11 23h2", "vendor": "microsoft", "type": "os", "affected": ["< 10.0.22631.7582"], "fixed": "10.0.22631.7582", "safe": null, "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "windows 11 24h2", "vendor": "microsoft", "type": "os", "affected": ["< 10.0.26100.9445"], "fixed": "10.0.26100.9445", "safe": null, "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "windows 11 25h2", "vendor": "microsoft", "type": "os", "affected": ["< 10.0.26200.9445"], "fixed": "10.0.26200.9445", "safe": null, "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "windows 11 26h1", "vendor": "microsoft", "type": "os", "affected": ["< 10.0.28000.2954"], "fixed": "10.0.28000.2954", "safe": null, "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "windows server 2025", "vendor": "microsoft", "type": "os", "affected": ["< 10.0.26100.33438"], "fixed": "10.0.26100.33438", "safe": null, "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-81963"}, {"t": "Patch, Vendor Advisory", "u": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963"}], "cwe": ["CWE-59", "CWE-284"], "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "L", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": "2026-09-22", "kev_added": "2026-09-08", "ransom": false, "priority": 65, "tier": "P0", "why": ["High severity", "Exploited in the wild (CISA KEV)", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.32362, "pinned": false, "pocs": [{"kind": "poc", "name": "rsah35404-star/stunning-octo-doodle (0 stars)", "url": "https://github.com/rsah35404-star/stunning-octo-doodle", "stars": 0}], "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}, {"os": "Windows Server 2025 (Server Core installation)", "pkg": "KB5122871", "status": "fixed", "fixed": "10.0.26100.33438", "cmd": "Install KB5122871 via Windows Update, then verify:\nGet-HotFix -Id KB5122871", "url": "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5122871", "note": "KB5122871"}, {"os": "Windows Server 2025", "pkg": "KB5122871", "status": "fixed", "fixed": "10.0.26100.33438", "cmd": "Install KB5122871 via Windows Update, then verify:\nGet-HotFix -Id KB5122871", "url": "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5122871", "note": "KB5122871"}, {"os": "Windows 11 Version 25H2 for ARM64-based Systems", "pkg": "KB5124008", "status": "fixed", "fixed": "10.0.26200.9445", "cmd": "Install KB5124008 via Windows Update, then verify:\nGet-HotFix -Id KB5124008", "url": "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5124008", "note": "KB5124008"}, {"os": "Windows 11 Version 25H2 for x64-based Systems", "pkg": "KB5124008", "status": "fixed", "fixed": "10.0.26200.9445", "cmd": "Install KB5124008 via Windows Update, then verify:\nGet-HotFix -Id KB5124008", "url": "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5124008", "note": "KB5124008"}, {"os": "Windows 11 Version 23H2 for ARM64-based Systems", "pkg": "KB5122880", "status": "fixed", "fixed": "10.0.22631.7582", "cmd": "Install KB5122880 via Windows Update, then verify:\nGet-HotFix -Id KB5122880", "url": "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5122880", "note": "KB5122880"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true}, {"id": "CVE-2026-75650", "publisher": "Adobe Systems Incorporated", "title": "Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability", "summary": "Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.", "cvss": 10.0, "sev": "CRITICAL", "epss": 0.03949, "kev": true, "added": "2026-09-07", "pub": "2026-09-07T21:17:30.863", "modified": "2026-09-09T05:18:07.237", "products": [{"name": "commerce", "vendor": "adobe", "type": "app", "affected": ["< 2.4.4", "2.4.4", "2.4.4 p1", "2.4.4 p10", "2.4.4 p11", "2.4.4 p12", "2.4.4 p13", "2.4.4 p14"], "fixed": "2.4.4", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy commerce || rpm -q commerce || commerce --version"}, {"label": "2. UPGRADE to 2.4.4 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade commerce"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade commerce"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}, {"name": "commerce b2b", "vendor": "adobe", "type": "app", "affected": ["< 1.3.3", "1.3.3", "1.3.3 p1", "1.3.3 p10", "1.3.3 p11", "1.3.3 p12", "1.3.3 p13", "1.3.3 p14"], "fixed": "1.3.3", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy commerce-b2b || rpm -q commerce-b2b || commerce-b2b --version"}, {"label": "2. UPGRADE to 1.3.3 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade commerce-b2b"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade commerce-b2b"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}, {"name": "magento", "vendor": "adobe", "type": "app", "affected": ["< 2.4.6", "2.4.6", "2.4.6 p1", "2.4.6 p10", "2.4.6 p11", "2.4.6 p12", "2.4.6 p13", "2.4.6 p14"], "fixed": "2.4.6", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy magento || rpm -q magento || magento --version"}, {"label": "2. UPGRADE to 2.4.6 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade magento"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade magento"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-75650"}, {"t": "Patch, Vendor Advisory", "u": "https://helpx.adobe.com/security/products/magento/apsb26-146.html"}], "cwe": ["CWE-1336"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-09-11", "kev_added": "2026-09-08", "ransom": false, "priority": 96, "tier": "P0", "why": ["Critical severity", "EPSS top 10%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.90376, "pinned": false, "pocs": [{"kind": "poc", "name": "fortbridge/stylesmuggler (7 stars)", "url": "https://github.com/fortbridge/stylesmuggler", "stars": 7}, {"kind": "poc", "name": "dinosn/cve-2026-75650-magento-validation-lab (6 stars)", "url": "https://github.com/dinosn/cve-2026-75650-magento-validation-lab", "stars": 6}, {"kind": "poc", "name": "disrex-group/stylesmuggler-adobe-patches (5 stars)", "url": "https://github.com/disrex-group/stylesmuggler-adobe-patches", "stars": 5}], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true}, {"id": "CVE-2026-86218", "publisher": "N-able", "title": "N-able N-central Static Code Injection Vulnerability", "summary": "N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.13349, "kev": true, "added": "2026-09-06", "pub": "2026-09-06T03:17:17.373", "modified": "2026-09-09T05:18:19.490", "products": [{"name": "n-central", "vendor": "n-able", "type": "app", "affected": ["< 2026.3", "2026.3", "2026.3 hotfix1", "2026.3 hotfix2", "2026.3 hotfix3"], "fixed": "2026.3", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy n-central || rpm -q n-central || n-central --version"}, {"label": "2. UPGRADE to 2026.3 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade n-central"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade n-central"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-86218"}, {"t": "Vendor Advisory", "u": "https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution"}], "cwe": ["CWE-96"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-09-11", "kev_added": "2026-09-08", "ransom": false, "priority": 96, "tier": "P0", "why": ["Critical severity", "EPSS top 4%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.96409, "pocs": [{"kind": "poc", "name": "HORKimhab/CVE-2026-86218 (0 stars)", "url": "https://github.com/HORKimhab/CVE-2026-86218", "stars": 0}, {"kind": "poc", "name": "Udyz/CVE-2026-86218 (0 stars)", "url": "https://github.com/Udyz/CVE-2026-86218", "stars": 0}, {"kind": "poc", "name": "super-meuw/CVE-2026-86218 (0 stars)", "url": "https://github.com/super-meuw/CVE-2026-86218", "stars": 0}, {"kind": "msf", "name": "N-able N-central Struts BeanUtils Unauthenticated RCE", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nable_ncentral_unauth_rce_cve_2026_86218.rb"}, {"kind": "nuclei", "name": "N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code Execution", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-86218.yaml"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true}, {"id": "CVE-2026-86060", "publisher": "CERT.PL", "title": "MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability", "summary": "RouterOS contains an argument-handling flaw in the SSH login\npath involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask\u00a0to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions:\u00a06.49.21 (Long-term),\u00a07.23.4 (Long-term)\u00a0and\u00a07.24.2 (Stable)", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.06392, "kev": true, "added": "2026-09-05", "pub": "2026-09-05T20:17:18.703", "modified": "2026-09-11T12:52:16.507", "products": [{"name": "routeros", "vendor": "mikrotik", "type": "os", "affected": [">= 6.0 and < 6.49.21", ">= 7.0 and < 7.23.4", ">= 7.24 and < 7.24.2"], "fixed": "6.49.21, 7.23.4, 7.24.2", "safe": "before 6.0", "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-86060"}, {"t": "Mitigation, Third Party Advisory", "u": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/"}, {"t": "Vendor Advisory", "u": "https://mikrotik.com/supportsec/september-2026-vulnerability/"}], "cwe": ["CWE-88"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-09-13", "kev_added": "2026-09-10", "ransom": false, "priority": 96, "tier": "P0", "why": ["Critical severity", "EPSS top 6%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.93656, "pocs": [{"kind": "poc", "name": "digiprosec/MicroTrick (55 stars)", "url": "https://github.com/digiprosec/MicroTrick", "stars": 55}, {"kind": "poc", "name": "gagaltotal/CVE-2026-mikrotik-poc (4 stars)", "url": "https://github.com/gagaltotal/CVE-2026-mikrotik-poc", "stars": 4}, {"kind": "poc", "name": "bahirul/cve-2026-86060 (1 stars)", "url": "https://github.com/bahirul/cve-2026-86060", "stars": 1}, {"kind": "writeup", "name": "forum.mikrotik.com/t/7-24-2-stable-is-released/272800", "url": "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800"}, {"kind": "edb", "name": "MikroTrick_ 7.24_ 7.24.2_ 7.0.0_ 7.23.4_ 6.0.0_ 6.49.21 - RCE", "url": "https://www.exploit-db.com/exploits/52683"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true, "mentions": [{"src": "CERT Polska", "group": "gov", "title": "MikroTrick: technical analysis, disclosure process, and the use of LLM agents", "url": "https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis/", "date": "2026-09-22"}, {"src": "CERT Polska", "group": "gov", "title": "Vulnerabilities in Mikrotik RouterOS software", "url": "https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve/", "date": "2026-09-05"}], "buzz": 1}, {"id": "CVE-2026-67279", "publisher": "CERT.PL", "title": "Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability", "summary": "RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic dat", "cvss": 6.5, "sev": "MEDIUM", "epss": 0.01046, "kev": true, "added": "2026-09-05", "pub": "2026-09-05T20:17:18.390", "modified": "2026-09-26T04:17:47.273", "products": [{"name": "routeros", "vendor": "mikrotik", "type": "os", "affected": [">= 6.0 and < 6.49.21", ">= 7.0 and < 7.23.4", ">= 7.24 and < 7.24.2"], "fixed": "6.49.21, 7.23.4, 7.24.2", "safe": "before 6.0", "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-67279"}, {"t": "Mitigation, Third Party Advisory", "u": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/"}, {"t": "Vendor Advisory", "u": "https://mikrotik.com/supportsec/september-2026-vulnerability/"}], "cwe": ["CWE-841"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-09-28", "kev_added": "2026-09-25", "ransom": false, "priority": 74, "tier": "P0", "why": ["Exploited in the wild (CISA KEV)", "Public exploit reference", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.63892, "pinned": false, "pocs": [{"kind": "poc", "name": "tc4dy/CVE-2026-67279-86060-Toolkit (5 stars)", "url": "https://github.com/tc4dy/CVE-2026-67279-86060-Toolkit", "stars": 5}, {"kind": "poc", "name": "HackSpeak/CVE-2026-67279 (4 stars)", "url": "https://github.com/HackSpeak/CVE-2026-67279", "stars": 4}, {"kind": "poc", "name": "shmaki4/CVE-2026-67279-Mikrotik-6.42-POC (0 stars)", "url": "https://github.com/shmaki4/CVE-2026-67279-Mikrotik-6.42-POC", "stars": 0}, {"kind": "writeup", "name": "bishopfox.com/blog/mikrotrick-inside-the-routeros-takeover-chain", "url": "https://bishopfox.com/blog/mikrotrick-inside-the-routeros-takeover-chain"}, {"kind": "writeup", "name": "forum.mikrotik.com/t/7-24-2-stable-is-released/272800", "url": "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800"}], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "partial"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true, "mentions": [{"src": "CERT Polska", "group": "gov", "title": "MikroTrick: technical analysis, disclosure process, and the use of LLM agents", "url": "https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis/", "date": "2026-09-22"}, {"src": "CERT Polska", "group": "gov", "title": "Vulnerabilities in Mikrotik RouterOS software", "url": "https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve/", "date": "2026-09-05"}], "buzz": 1}, {"id": "CVE-2026-67277", "publisher": "CERT.PL", "title": "MikroTik RouterOS Missing Authentication for Critical Function Vulnerability", "summary": "RouterOS accepts a \"related\" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With \"random-data=false\", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel.\n\n\n", "cvss": 8.2, "sev": "HIGH", "epss": 0.0156, "kev": true, "added": "2026-09-05", "pub": "2026-09-05T20:17:18.120", "modified": "2026-09-11T12:52:29.533", "products": [{"name": "routeros", "vendor": "mikrotik", "type": "os", "affected": [">= 6.0 and < 6.49.21", ">= 7.0 and < 7.23.4", ">= 7.24 and < 7.24.2"], "fixed": "6.49.21, 7.23.4, 7.24.2", "safe": "before 6.0", "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-67277"}, {"t": "Mitigation, Third Party Advisory", "u": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/"}, {"t": "Vendor Advisory", "u": "https://mikrotik.com/supportsec/september-2026-vulnerability/"}], "cwe": ["CWE-306"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-09-13", "kev_added": "2026-09-10", "ransom": false, "priority": 82, "tier": "P0", "why": ["High severity", "Exploited in the wild (CISA KEV)", "Public exploit reference", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.75058, "pinned": false, "pocs": [{"kind": "writeup", "name": "forum.mikrotik.com/t/7-24-2-stable-is-released/272800", "url": "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800"}], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "partial"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true}, {"id": "CVE-2026-85046", "publisher": "Chrome", "title": "Google Chromium V8 Type Confusion Vulnerability", "summary": "Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)", "cvss": 8.8, "sev": "HIGH", "epss": 0.48881, "kev": true, "added": "2026-09-03", "pub": "2026-09-03T20:17:24.210", "modified": "2026-09-21T13:17:10.970", "products": [{"name": "chrome", "vendor": "google", "type": "app", "affected": ["< 152.0.7977.82"], "fixed": "152.0.7977.82", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy chrome || rpm -q chrome || chrome --version"}, {"label": "2. UPGRADE to 152.0.7977.82 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade chrome"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade chrome"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}, {"name": "v8", "vendor": "google", "type": "app", "affected": ["< 15.3.48"], "fixed": "15.3.48", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy v8 || rpm -q v8 || v8 --version"}, {"label": "2. UPGRADE to 15.3.48 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade v8"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade v8"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-85046"}, {"t": "Release Notes, Vendor Advisory", "u": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html"}, {"t": "Patch", "u": "https://github.com/v8/v8/commit/e0562d87ad9c17042b581582c99237d798572e67"}], "cwe": ["CWE-843"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "R"}, "remote": false, "exploit": true, "kev_due": "2026-09-18", "kev_added": "2026-09-04", "ransom": false, "priority": 86, "tier": "P0", "why": ["High severity", "EPSS top 1%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference"], "fix": true, "watched": false, "epss_pct": 0.98877, "pinned": false, "pocs": [{"kind": "poc", "name": "atiilla/CVE-2026-85046 (8 stars)", "url": "https://github.com/atiilla/CVE-2026-85046", "stars": 8}, {"kind": "poc", "name": "adriyansyah-mf/cve-2026-85046-poc (6 stars)", "url": "https://github.com/adriyansyah-mf/cve-2026-85046-poc", "stars": 6}, {"kind": "poc", "name": "HORKimhab/CVE-2026-85046 (1 stars)", "url": "https://github.com/HORKimhab/CVE-2026-85046", "stars": 1}, {"kind": "writeup", "name": "issues.chromium.org/issues/542403045", "url": "https://issues.chromium.org/issues/542403045"}], "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}, {"os": "Ubuntu 22.04", "pkg": "chromium-browser", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Ubuntu 24.04", "pkg": "chromium-browser", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Debian 12", "pkg": "chromium", "status": "fixed", "fixed": "152.0.7977.82-1~deb12u1", "cmd": "sudo apt update && sudo apt install --only-upgrade chromium\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' chromium)\" ge \"152.0.7977.82-1~deb12u1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Debian 13", "pkg": "chromium", "status": "fixed", "fixed": "152.0.7977.82-1~deb13u1", "cmd": "sudo apt update && sudo apt install --only-upgrade chromium\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' chromium)\" ge \"152.0.7977.82-1~deb13u1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true}, {"id": "CVE-2026-83549", "publisher": "SonicWALL, Inc.", "title": "SonicWall SMA1000 Appliances OS Command Injection Vulnerability", "summary": "Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.", "cvss": 7.8, "sev": "HIGH", "epss": 0.09889, "kev": true, "added": "2026-09-01", "pub": "2026-09-01T22:17:13.290", "modified": "2026-09-21T14:17:21.703", "products": [{"name": "sma8200v", "vendor": "sonicwall", "type": "app", "affected": ["< 12.4.3-03526", ">= 12.5.0 and < 12.5.0-02952"], "fixed": "12.4.3-03526, 12.5.0-02952", "safe": "before 12.5.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy sma8200v || rpm -q sma8200v || sma8200v --version"}, {"label": "2. UPGRADE to 12.4.3-03526 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade sma8200v"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade sma8200v"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 12.5.0 (Debian / Ubuntu)", "cmd": "apt-cache madison sma8200v\nsudo apt install sma8200v=<VERSION_BEFORE_12.5.0>\nsudo apt-mark hold sma8200v"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list sma8200v\nsudo dnf downgrade sma8200v-<VERSION_BEFORE_12.5.0>\nsudo dnf versionlock add sma8200v"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "sma6210 firmware", "vendor": "sonicwall", "type": "os", "affected": ["< 12.4.3-03526", ">= 12.5.0 and < 12.5.0-02952"], "fixed": "12.4.3-03526, 12.5.0-02952", "safe": "before 12.5.0", "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "sma7210 firmware", "vendor": "sonicwall", "type": "os", "affected": ["< 12.4.3-03526", ">= 12.5.0 and < 12.5.0-02952"], "fixed": "12.4.3-03526, 12.5.0-02952", "safe": "before 12.5.0", "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-83549"}, {"t": "Vendor Advisory", "u": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016"}], "cwe": ["CWE-78"], "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "L", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": true, "kev_due": "2026-09-05", "kev_added": "2026-09-02", "ransom": false, "priority": 81, "tier": "P0", "why": ["High severity", "EPSS top 4%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference"], "fix": true, "watched": false, "epss_pct": 0.95573, "pocs": [{"kind": "msf", "name": "SonicWall SMA1000 WorkPlace SSRF to Root Remote Code Execution", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/sonicwall_sma1000_couchdb_rce.rb"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true}, {"id": "CVE-2026-83548", "publisher": "SonicWALL, Inc.", "title": "SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability", "summary": "A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.", "cvss": 10.0, "sev": "CRITICAL", "epss": 0.08043, "kev": true, "added": "2026-09-01", "pub": "2026-09-01T22:17:13.170", "modified": "2026-09-03T13:06:16.053", "products": [{"name": "sma8200v", "vendor": "sonicwall", "type": "app", "affected": ["< 12.4.3-03526", ">= 12.5.0 and < 12.5.0-02952"], "fixed": "12.4.3-03526, 12.5.0-02952", "safe": "before 12.5.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy sma8200v || rpm -q sma8200v || sma8200v --version"}, {"label": "2. UPGRADE to 12.4.3-03526 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade sma8200v"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade sma8200v"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 12.5.0 (Debian / Ubuntu)", "cmd": "apt-cache madison sma8200v\nsudo apt install sma8200v=<VERSION_BEFORE_12.5.0>\nsudo apt-mark hold sma8200v"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list sma8200v\nsudo dnf downgrade sma8200v-<VERSION_BEFORE_12.5.0>\nsudo dnf versionlock add sma8200v"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "sma6210 firmware", "vendor": "sonicwall", "type": "os", "affected": ["< 12.4.3-03526", ">= 12.5.0 and < 12.5.0-02952"], "fixed": "12.4.3-03526, 12.5.0-02952", "safe": "before 12.5.0", "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "sma7210 firmware", "vendor": "sonicwall", "type": "os", "affected": ["< 12.4.3-03526", ">= 12.5.0 and < 12.5.0-02952"], "fixed": "12.4.3-03526, 12.5.0-02952", "safe": "before 12.5.0", "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-83548"}, {"t": "Vendor Advisory", "u": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016"}], "cwe": ["CWE-441", "CWE-918"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-09-05", "kev_added": "2026-09-02", "ransom": false, "priority": 97, "tier": "P0", "why": ["Critical severity", "EPSS top 5%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.94784, "pocs": [{"kind": "poc", "name": "xoessie/CVE-2026-83548-SonicWall-SMA1000-Analysis (0 stars)", "url": "https://github.com/xoessie/CVE-2026-83548-SonicWall-SMA1000-Analysis", "stars": 0}, {"kind": "poc", "name": "xcoy0te/CVE-2026-83548-checker (0 stars)", "url": "https://github.com/xcoy0te/CVE-2026-83548-checker", "stars": 0}, {"kind": "poc", "name": "HORKimhab/CVE-2026-83548-CVE-2026-83549 (0 stars)", "url": "https://github.com/HORKimhab/CVE-2026-83548-CVE-2026-83549", "stars": 0}, {"kind": "msf", "name": "SonicWall SMA1000 WorkPlace SSRF to Root Remote Code Execution", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/sonicwall_sma1000_couchdb_rce.rb"}, {"kind": "nuclei", "name": "SonicWall SMA1000 WorkPlace - Unauthenticated SSRF to CouchDB", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-83548.yaml"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true, "mentions": [{"src": "CERT-FR Alerts", "group": "gov", "title": "Multiples vuln\u00e9rabilit\u00e9s dans SonicWall Secure Mobile Access (02 septembre 2026)", "url": "https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-009/", "date": "2026-09-02"}], "buzz": 1}, {"id": "CVE-2026-82329", "publisher": "JFrog", "title": "JFrog Artifactory Improper Authentication Vulnerability", "summary": "JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.14372, "kev": true, "added": "2026-08-28", "pub": "2026-08-28T20:20:21.293", "modified": "2026-09-03T13:06:15.630", "products": [{"name": "artifactory", "vendor": "jfrog", "type": "app", "affected": [">= 7.111.4 and < 7.111.21", ">= 7.117.0 and < 7.117.28", ">= 7.125.0 and < 7.125.20", ">= 7.133.0 and < 7.133.29", ">= 7.146.0 and < 7.146.38", ">= 7.161.0 and < 7.161.20"], "fixed": "7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20", "safe": "before 7.111.4", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy artifactory || rpm -q artifactory || artifactory --version"}, {"label": "2. UPGRADE to 7.111.21 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade artifactory"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade artifactory"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 7.111.4 (Debian / Ubuntu)", "cmd": "apt-cache madison artifactory\nsudo apt install artifactory=<VERSION_BEFORE_7.111.4>\nsudo apt-mark hold artifactory"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list artifactory\nsudo dnf downgrade artifactory-<VERSION_BEFORE_7.111.4>\nsudo dnf versionlock add artifactory"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-82329"}, {"t": "Vendor Advisory", "u": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"}], "cwe": ["CWE-287"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-09-05", "kev_added": "2026-09-02", "ransom": false, "priority": 96, "tier": "P0", "why": ["Critical severity", "EPSS top 3%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.96617, "pocs": [{"kind": "poc", "name": "dinosn/cve-2026-82329-jfrog-artifactory (12 stars)", "url": "https://github.com/dinosn/cve-2026-82329-jfrog-artifactory", "stars": 12}, {"kind": "poc", "name": "ynsmroztas/CVE-2026-82329-JFrog-Artifactory-Auth-Bypass (6 stars)", "url": "https://github.com/ynsmroztas/CVE-2026-82329-JFrog-Artifactory-Auth-Bypass", "stars": 6}, {"kind": "poc", "name": "tc4dy/CVE-2026-82329-PoC-Exploit (4 stars)", "url": "https://github.com/tc4dy/CVE-2026-82329-PoC-Exploit", "stars": 4}, {"kind": "nuclei", "name": "JFrog Artifactory Access Blank Join Key Authentication Bypass", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-82329.yaml"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true, "mentions": [{"src": "Wiz Research", "group": "research", "title": "Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329", "url": "https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201", "date": "2026-09-10"}], "buzz": 1}, {"id": "CVE-2026-82078", "publisher": "PaperCut", "title": "PaperCut NG/MF Unsafe Reflection Vulnerability", "summary": "An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security conte", "cvss": 9.1, "sev": "CRITICAL", "epss": 0.63532, "kev": true, "added": "2026-08-28", "pub": "2026-08-28T16:18:31.240", "modified": "2026-09-14T00:16:56.777", "products": [{"name": "papercut mf", "vendor": "papercut", "type": "app", "affected": ["< 24.1.9", ">= 25.0.2 and < 25.0.12", ">= 26.0.2 and < 26.0.4"], "fixed": "24.1.9, 25.0.12, 26.0.4", "safe": "before 25.0.2", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy papercut-mf || rpm -q papercut-mf || papercut-mf --version"}, {"label": "2. UPGRADE to 24.1.9 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade papercut-mf"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade papercut-mf"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 25.0.2 (Debian / Ubuntu)", "cmd": "apt-cache madison papercut-mf\nsudo apt install papercut-mf=<VERSION_BEFORE_25.0.2>\nsudo apt-mark hold papercut-mf"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list papercut-mf\nsudo dnf downgrade papercut-mf-<VERSION_BEFORE_25.0.2>\nsudo dnf versionlock add papercut-mf"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "papercut ng", "vendor": "papercut", "type": "app", "affected": ["< 24.1.9", ">= 25.0.2 and < 25.0.12", ">= 26.0.2 and < 26.0.4"], "fixed": "24.1.9, 25.0.12, 26.0.4", "safe": "before 25.0.2", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy papercut-ng || rpm -q papercut-ng || papercut-ng --version"}, {"label": "2. UPGRADE to 24.1.9 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade papercut-ng"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade papercut-ng"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 25.0.2 (Debian / Ubuntu)", "cmd": "apt-cache madison papercut-ng\nsudo apt install papercut-ng=<VERSION_BEFORE_25.0.2>\nsudo apt-mark hold papercut-ng"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list papercut-ng\nsudo dnf downgrade papercut-ng-<VERSION_BEFORE_25.0.2>\nsudo dnf versionlock add papercut-ng"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-82078"}, {"t": "Patch, Vendor Advisory", "u": "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/"}, {"t": "Issue Tracking, Patch", "u": "https://github.com/rapid7/metasploit-framework/pull/21842"}, {"t": "Patch, Third Party Advisory", "u": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82078"}], "cwe": ["CWE-470"], "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "H", "ui": "N"}, "remote": false, "exploit": true, "kev_due": "2026-09-14", "kev_added": "2026-08-31", "ransom": false, "priority": 87, "tier": "P0", "why": ["Critical severity", "EPSS top 1%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference"], "fix": true, "watched": false, "epss_pct": 0.99214, "pocs": [{"kind": "msf", "name": "PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/papercut_ng_external_user_lookup_rce.rb"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true, "mentions": [{"src": "watchTowr Labs", "group": "research", "title": "Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578", "url": "https://labs.watchtowr.com/death-by-a-thousand-papercuts-papercut-pre-auth-rce-chain-and-patch-bypasses-wt-2026-0141-0144-cve-2026-82077-cve-2026-82078-cve-2026-81578/", "date": "2026-10-09"}], "buzz": 1}, {"id": "CVE-2026-81578", "publisher": "PaperCut", "title": "PaperCut NG/MF Missing Authentication for Critical Function Vulnerability", "summary": "An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific\u00a0conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the  completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.85581, "kev": true, "added": "2026-08-28", "pub": "2026-08-28T16:18:29.600", "modified": "2026-09-14T00:16:56.207", "products": [{"name": "papercut mf", "vendor": "papercut", "type": "app", "affected": ["< 24.1.9", ">= 25.0.2 and < 25.0.12", ">= 26.0.2 and < 26.0.4"], "fixed": "24.1.9, 25.0.12, 26.0.4", "safe": "before 25.0.2", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy papercut-mf || rpm -q papercut-mf || papercut-mf --version"}, {"label": "2. UPGRADE to 24.1.9 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade papercut-mf"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade papercut-mf"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 25.0.2 (Debian / Ubuntu)", "cmd": "apt-cache madison papercut-mf\nsudo apt install papercut-mf=<VERSION_BEFORE_25.0.2>\nsudo apt-mark hold papercut-mf"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list papercut-mf\nsudo dnf downgrade papercut-mf-<VERSION_BEFORE_25.0.2>\nsudo dnf versionlock add papercut-mf"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "papercut ng", "vendor": "papercut", "type": "app", "affected": ["< 24.1.9", ">= 25.0.2 and < 25.0.12", ">= 26.0.2 and < 26.0.4"], "fixed": "24.1.9, 25.0.12, 26.0.4", "safe": "before 25.0.2", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy papercut-ng || rpm -q papercut-ng || papercut-ng --version"}, {"label": "2. UPGRADE to 24.1.9 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade papercut-ng"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade papercut-ng"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 25.0.2 (Debian / Ubuntu)", "cmd": "apt-cache madison papercut-ng\nsudo apt install papercut-ng=<VERSION_BEFORE_25.0.2>\nsudo apt-mark hold papercut-ng"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list papercut-ng\nsudo dnf downgrade papercut-ng-<VERSION_BEFORE_25.0.2>\nsudo dnf versionlock add papercut-ng"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-81578"}, {"t": "Patch, Vendor Advisory", "u": "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/"}, {"t": "Issue Tracking, Patch", "u": "https://github.com/rapid7/metasploit-framework/pull/21842"}, {"t": "Patch, Third Party Advisory", "u": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81578"}], "cwe": ["CWE-305"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-09-14", "kev_added": "2026-08-31", "ransom": false, "priority": 94, "tier": "P0", "why": ["Critical severity", "EPSS top 1%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.99726, "pocs": [{"kind": "poc", "name": "yora1928/PaperCut-CVE-2026-81578-82078 (4 stars)", "url": "https://github.com/yora1928/PaperCut-CVE-2026-81578-82078", "stars": 4}, {"kind": "poc", "name": "virologi-info/papercut-toolkit (2 stars)", "url": "https://github.com/virologi-info/papercut-toolkit", "stars": 2}, {"kind": "msf", "name": "PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/papercut_ng_external_user_lookup_rce.rb"}, {"kind": "nuclei", "name": "PaperCut NG/MF <=26.0.4 - Unauthenticated ConfigEditor Access via Tapestry Complex-Direct", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-81578.yaml"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "partial"}, "vendors": [{"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true, "mentions": [{"src": "watchTowr Labs", "group": "research", "title": "Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578", "url": "https://labs.watchtowr.com/death-by-a-thousand-papercuts-papercut-pre-auth-rce-chain-and-patch-bypasses-wt-2026-0141-0144-cve-2026-82077-cve-2026-82078-cve-2026-81578/", "date": "2026-10-09"}], "buzz": 1}, {"id": "CVE-2026-60004", "publisher": "MITRE", "title": "Gitea Code Injection Vulnerability", "summary": "Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.23988, "kev": true, "added": "2026-08-26", "pub": "2026-08-26T20:17:56.010", "modified": "2026-08-27T11:41:19.230", "products": [{"name": "gitea", "vendor": "gitea", "type": "app", "affected": [">= 1.17.0 and < 1.27.1"], "fixed": "1.27.1", "safe": "before 1.17.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy gitea || rpm -q gitea || gitea --version"}, {"label": "2. UPGRADE to 1.27.1 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade gitea"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade gitea"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 1.17.0 (Debian / Ubuntu)", "cmd": "apt-cache madison gitea\nsudo apt install gitea=<VERSION_BEFORE_1.17.0>\nsudo apt-mark hold gitea"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list gitea\nsudo dnf downgrade gitea-<VERSION_BEFORE_1.17.0>\nsudo dnf versionlock add gitea"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-60004"}, {"t": "Exploit, Mitigation", "u": "https://github.com/0xBlackash/CVE-2026-60004"}, {"t": "Exploit, Vendor Advisory", "u": "https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m"}], "cwe": ["CWE-94"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-08-28", "kev_added": "2026-08-25", "ransom": false, "priority": 97, "tier": "P0", "why": ["Critical severity", "EPSS top 2%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.97841, "pocs": [{"kind": "poc", "name": "imbas007/CVE-2026-60004-POC (17 stars)", "url": "https://github.com/imbas007/CVE-2026-60004-POC", "stars": 17}, {"kind": "poc", "name": "0xBlackash/CVE-2026-60004 (6 stars)", "url": "https://github.com/0xBlackash/CVE-2026-60004", "stars": 6}, {"kind": "poc", "name": "HORKimhab/CVE-2026-60004 (5 stars)", "url": "https://github.com/HORKimhab/CVE-2026-60004", "stars": 5}, {"kind": "nuclei", "name": "Gitea <= 1.27.0 - Pre-Auth Remote Code Execution", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-60004.yaml"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Go", "pkg": "gitea.dev", "status": "fixed", "fixed": "1.27.1", "cmd": "go get gitea.dev@v1.27.1\ngo list -m gitea.dev", "url": "https://github.com/advisories/GHSA-rcr6-4jqh-j84m", "note": "vulnerable: >= 1.17.0, < 1.27.1"}, {"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}, {"os": "Alpine 3.24", "pkg": "forgejo", "status": "fixed", "fixed": "forgejo-15.0.6-r0", "cmd": "apk add --upgrade forgejo\napk info -v forgejo", "url": null, "note": null}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true, "mentions": [{"src": "Canadian Cyber Centre", "group": "gov", "title": "Gitea security advisory (AV26-845) - Update 1", "url": "https://cyber.gc.ca/en/alerts-advisories/gitea-security-advisory-av26-845", "date": "2026-10-20"}], "buzz": 1}, {"id": "CVE-2026-19490", "publisher": "NetScaler", "title": "Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability", "summary": "Vulnerability in NetScaler ADC and NetScaler Gateway.\n\nThis issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.23158, "kev": true, "added": "2026-08-19", "pub": "2026-08-19T13:17:45.000", "modified": "2026-10-07T19:17:36.500", "products": [{"name": "netscaler application delivery controller", "vendor": "citrix", "type": "app", "affected": [">= 13.1 and < 13.1-37.277", ">= 13.1 and < 13.1-63.21", ">= 14.1 and < 14.1-73.32", ">= 14.1-66.68 and <= 14.1-73.32"], "fixed": "13.1-37.277, 13.1-63.21, 14.1-73.32", "safe": "before 13.1", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy netscaler-application-delivery-controller || rpm -q netscaler-application-delivery-controller || netscaler-application-delivery-controller --version"}, {"label": "2. UPGRADE to 13.1-37.277 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade netscaler-application-delivery-controller"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade netscaler-application-delivery-controller"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 13.1 (Debian / Ubuntu)", "cmd": "apt-cache madison netscaler-application-delivery-controller\nsudo apt install netscaler-application-delivery-controller=<VERSION_BEFORE_13.1>\nsudo apt-mark hold netscaler-application-delivery-controller"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list netscaler-application-delivery-controller\nsudo dnf downgrade netscaler-application-delivery-controller-<VERSION_BEFORE_13.1>\nsudo dnf versionlock add netscaler-application-delivery-controller"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "netscaler gateway", "vendor": "citrix", "type": "app", "affected": [">= 13.1 and < 13.1-63.21", ">= 14.1 and < 14.1-73.32"], "fixed": "13.1-63.21, 14.1-73.32", "safe": "before 13.1", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy netscaler-gateway || rpm -q netscaler-gateway || netscaler-gateway --version"}, {"label": "2. UPGRADE to 13.1-63.21 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade netscaler-gateway"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade netscaler-gateway"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 13.1 (Debian / Ubuntu)", "cmd": "apt-cache madison netscaler-gateway\nsudo apt install netscaler-gateway=<VERSION_BEFORE_13.1>\nsudo apt-mark hold netscaler-gateway"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list netscaler-gateway\nsudo dnf downgrade netscaler-gateway-<VERSION_BEFORE_13.1>\nsudo dnf versionlock add netscaler-gateway"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-19490"}, {"t": "Vendor Advisory", "u": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939"}], "cwe": ["CWE-288"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-09-12", "kev_added": "2026-09-09", "ransom": false, "priority": 97, "tier": "P0", "why": ["Critical severity", "EPSS top 2%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.97767, "pinned": false, "pocs": [{"kind": "poc", "name": "TarPeg007/CVE-2026-19490 (18 stars)", "url": "https://github.com/TarPeg007/CVE-2026-19490", "stars": 18}, {"kind": "poc", "name": "BishopFox/CVE-2026-19490-check (1 stars)", "url": "https://github.com/BishopFox/CVE-2026-19490-check", "stars": 1}], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true}, {"id": "CVE-2026-18963", "publisher": "Red Hat, Inc.", "title": "A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine fo", "summary": "A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.", "cvss": 9.1, "sev": "CRITICAL", "epss": 0.06407, "kev": false, "added": "2026-08-18", "pub": "2026-08-18T17:16:57.083", "modified": "2026-10-23T17:17:21.527", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-18963"}], "cwe": ["CWE-640"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": null, "kev_added": null, "ransom": false, "priority": 68, "tier": "P1", "why": ["Critical severity", "EPSS top 6%: very likely to be exploited", "Public exploit reference", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.93666, "vendors": [{"os": "Maven", "pkg": "org.keycloak:keycloak-services", "status": "fixed", "fixed": "26.4.15", "cmd": "Set org.keycloak:keycloak-services to 26.4.15 or later in pom.xml or build.gradle, then rebuild and redeploy.", "url": "https://github.com/advisories/GHSA-4gv3-mc9p-5wqc", "note": "vulnerable: >= 26.0.0, < 26.4.15"}, {"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:20:06.595246+00:00", "vendor_fixed": true, "pocs": [{"kind": "poc", "name": "ynsmroztas/KeySniper (120 stars)", "url": "https://github.com/ynsmroztas/KeySniper", "stars": 120}, {"kind": "poc", "name": "Snizi/CVE-2026-18963-Exploit (45 stars)", "url": "https://github.com/Snizi/CVE-2026-18963-Exploit", "stars": 45}, {"kind": "poc", "name": "Red-Darkin/CVE-2026-18963-keycloak (20 stars)", "url": "https://github.com/Red-Darkin/CVE-2026-18963-keycloak", "stars": 20}, {"kind": "edb", "name": "Keycloak  26.7.2 - Unauthenticated Account Takeover", "url": "https://www.exploit-db.com/exploits/52699"}, {"kind": "nuclei", "name": "Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-18963.yaml"}], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-15748", "publisher": "Wordfence", "title": "The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and in", "summary": "The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler that trusts attacker-controlled upload field configu", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.06138, "kev": false, "added": "2026-08-18", "modified": "2026-10-22T22:10:00.250", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-15748"}], "cwe": ["CWE-434"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 66, "tier": "P1", "why": ["Critical severity", "EPSS top 7%: very likely to be exploited", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.93441, "pinned": false, "pocs": [{"kind": "poc", "name": "yora1928/cve-2026-15748 (3 stars)", "url": "https://github.com/yora1928/cve-2026-15748", "stars": 3}, {"kind": "poc", "name": "ubaydev/CVE-2026-15748 (0 stars)", "url": "https://github.com/ubaydev/CVE-2026-15748", "stars": 0}, {"kind": "poc", "name": "0x4cr/CVE-2026-15748 (0 stars)", "url": "https://github.com/0x4cr/CVE-2026-15748", "stars": 0}], "vendors": [{"os": "Fedora 46", "pkg": "python-streamlink", "status": "fixed", "fixed": "8.6.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-a56fcfdc08", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-a56fcfdc08", "note": "FEDORA-2026-a56fcfdc08"}, {"os": "Fedora ELN", "pkg": "valgrind", "status": "fixed", "fixed": "3.28.0-1.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-c593ef1d15", "note": "FEDORA-2026-c593ef1d15"}], "vendors_checked": "2026-10-24T06:05:19.655601+00:00", "vendor_fixed": true, "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}}, {"id": "CVE-2026-73487", "publisher": "VulnCheck", "title": "Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that ", "summary": "Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection. Attackers can exploit unblocked pandas functions like pd.read_json() to exfiltrate datasets, perform SSRF against internal services, or achieve code execution through the unauthenticated prediction API.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.00961, "kev": false, "added": "2026-08-13", "pub": "2026-08-13T12:17:24.083", "modified": "2026-10-23T18:10:00.167", "products": [{"name": "flowise", "vendor": "flowiseai", "type": "app", "affected": ["<= 3.1.4"], "fixed": "newer than 3.1.4", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy flowise || rpm -q flowise || flowise --version"}, {"label": "2. UPGRADE to newer than 3.1.4 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade flowise"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade flowise"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-73487"}, {"t": "Exploit, Mitigation", "u": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-w7x8-q2gp-5cgg"}, {"t": "Exploit, Mitigation", "u": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-w7x8-q2gp-5cgg"}], "cwe": ["CWE-94"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": null, "kev_added": null, "ransom": false, "priority": 63, "tier": "P1", "why": ["Critical severity", "Public exploit reference", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.61218, "vendors": [{"os": "npm", "pkg": "flowise", "status": "fixed", "fixed": "3.1.3", "cmd": "npm install flowise@\">=3.1.3\"\nnpm ls flowise", "url": "https://github.com/advisories/GHSA-w7x8-q2gp-5cgg", "note": "vulnerable: <= 3.1.2"}, {"os": "npm", "pkg": "flowise-components", "status": "fixed", "fixed": "3.1.3", "cmd": "npm install flowise-components@\">=3.1.3\"\nnpm ls flowise-components", "url": "https://github.com/advisories/GHSA-w7x8-q2gp-5cgg", "note": "vulnerable: <= 3.1.2"}, {"os": "Fedora 46", "pkg": "wasmedge", "status": "fixed", "fixed": "0.18.1-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-4c27216e39", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-4c27216e39", "note": "FEDORA-2026-4c27216e39"}], "vendors_checked": "2026-10-23T18:12:00.013625+00:00", "vendor_fixed": true, "pocs": [{"kind": "writeup", "name": "github.com/FlowiseAI/Flowise/security/advisories/GHSA-w7x8-q2gp-5cgg", "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-w7x8-q2gp-5cgg"}], "ssvc": {"exploitation": "poc", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-73299", "publisher": "GitHub, Inc.", "title": "Prompty is a markdown file format (.prompty) for LLM prompts", "summary": "Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process. This issue is fixed in versions 0.1.5 and 2.0.0-beta.5.", "cvss": 10.0, "sev": "CRITICAL", "epss": 0.01784, "kev": false, "added": "2026-08-12", "pub": "2026-08-12T18:18:15.197", "modified": "2026-10-23T19:10:00.167", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-73299"}], "cwe": ["CWE-94", "CWE-1336"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 63, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.78144, "vendors": [{"os": "Fedora 46", "pkg": "diffoscope", "status": "fixed", "fixed": "335-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-e4c4cc0856", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-e4c4cc0856", "note": "FEDORA-2026-e4c4cc0856"}], "vendors_checked": "2026-10-23T19:12:48.430812+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-42018", "publisher": "JFrog", "title": "JFrog Artifactory Improper Authentication Vulnerability", "summary": "JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.", "cvss": 7.5, "sev": "HIGH", "epss": 0.09805, "kev": true, "added": "2026-08-12", "pub": "2026-08-12T18:17:29.473", "modified": "2026-10-23T19:10:00.167", "products": [{"name": "artifactory", "vendor": "jfrog", "type": "app", "affected": ["< 7.111.20", ">= 7.117.0 and < 7.117.27", ">= 7.125.0 and < 7.125.19", ">= 7.133.0 and < 7.133.28", ">= 7.146.0 and < 7.146.8"], "fixed": "7.111.20, 7.117.27, 7.125.19, 7.133.28, 7.146.8", "safe": "before 7.117.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy artifactory || rpm -q artifactory || artifactory --version"}, {"label": "2. UPGRADE to 7.111.20 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade artifactory"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade artifactory"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 7.117.0 (Debian / Ubuntu)", "cmd": "apt-cache madison artifactory\nsudo apt install artifactory=<VERSION_BEFORE_7.117.0>\nsudo apt-mark hold artifactory"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list artifactory\nsudo dnf downgrade artifactory-<VERSION_BEFORE_7.117.0>\nsudo dnf versionlock add artifactory"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-42018"}, {"t": "Vendor Advisory", "u": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"}], "cwe": ["CWE-287"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": "2026-09-25", "kev_added": "2026-09-11", "ransom": false, "priority": 80, "tier": "P0", "why": ["High severity", "EPSS top 4%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.95546, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true, "pocs": [{"kind": "writeup", "name": "www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-20", "url": "https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201"}, {"kind": "nuclei", "name": "JFrog Artifactory - Anonymous Token Disclosure via Trailing Slash Auth Bypass", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42018.yaml"}], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "partial"}, "mentions": [{"src": "Wiz Research", "group": "research", "title": "Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329", "url": "https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201", "date": "2026-09-10"}], "buzz": 1, "pinned": false}, {"id": "CVE-2026-73296", "publisher": "GitHub, Inc.", "title": "Microsoft UFO open-source framework for intelligent automation across devices and platforms", "summary": "Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without authentication, allowing an unauthenticated remote attacker to invoke capture_screenshot, get_ui_tree, tap, swipe, type_text, launch_app, press_key,", "cvss": 9.4, "sev": "CRITICAL", "epss": 0.03652, "kev": false, "added": "2026-08-12", "pub": "2026-08-12T17:17:32.780", "modified": "2026-10-23T19:10:00.167", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-73296"}], "cwe": ["CWE-306", "CWE-862"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 71, "tier": "P1", "why": ["Critical severity", "CISA SSVC: public proof of concept", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.89562, "vendors": [{"os": "Fedora 46", "pkg": "diffoscope", "status": "fixed", "fixed": "335-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-e4c4cc0856", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-e4c4cc0856", "note": "FEDORA-2026-e4c4cc0856"}], "vendors_checked": "2026-10-23T19:12:48.430812+00:00", "vendor_fixed": true, "pocs": [{"kind": "poc", "name": "0xBlackash/CVE-2026-73296 (0 stars)", "url": "https://github.com/0xBlackash/CVE-2026-73296", "stars": 0}, {"kind": "writeup", "name": "github.com/microsoft/UFO/security/advisories/GHSA-24fq-m9rr-g3mm", "url": "https://github.com/microsoft/UFO/security/advisories/GHSA-24fq-m9rr-g3mm"}], "ssvc": {"exploitation": "poc", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-73240", "publisher": "Apache Software Foundation", "title": "Specifically crafted inputs may lead to git argument injection in Apache Allura.\n\nThis issue affects Apache Al", "summary": "Specifically crafted inputs may lead to git argument injection in Apache Allura.\n\nThis issue affects Apache Allura: before 1.19.1.\n\nUsers are recommended to upgrade to version 1.19.1, which fixes the issue.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.01043, "kev": false, "added": "2026-08-12", "pub": "2026-08-12T17:17:32.307", "modified": "2026-10-23T19:10:00.167", "products": [{"name": "allura", "vendor": "apache", "type": "app", "affected": ["< 1.19.1"], "fixed": "1.19.1", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy allura || rpm -q allura || allura --version"}, {"label": "2. UPGRADE to 1.19.1 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade allura"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade allura"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-73240"}, {"t": "Mailing List, Vendor Advisory", "u": "https://lists.apache.org/thread/10gnxblhomk2z4gxcyyb4t3p4zxsdddv"}], "cwe": ["CWE-88"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 63, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.63817, "vendors": [{"os": "Fedora 46", "pkg": "diffoscope", "status": "fixed", "fixed": "335-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-e4c4cc0856", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-e4c4cc0856", "note": "FEDORA-2026-e4c4cc0856"}], "vendors_checked": "2026-10-23T19:12:48.430812+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-73034", "publisher": "VulnCheck", "title": "DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write a", "summary": "DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user_id HTTP header of the Python file-upload endpoint. Attackers can send a crafted multipart upload request with a traversal-poisoned user_id header to escape the intended upload directory and write attacker-controlled content to locations s", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.05703, "kev": false, "added": "2026-08-11", "pub": "2026-08-11T20:18:46.470", "modified": "2026-10-23T20:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-73034"}], "cwe": ["CWE-22"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 69, "tier": "P1", "why": ["Critical severity", "EPSS top 7%: very likely to be exploited", "CISA SSVC: public proof of concept", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.92992, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [{"kind": "poc", "name": "Boreas37/CVE-2026-73034-PoC (1 stars)", "url": "https://github.com/Boreas37/CVE-2026-73034-PoC", "stars": 1}, {"kind": "nuclei", "name": "DB-GPT <= 0.8.1 - Arbitrary File Write", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-73034.yaml"}], "ssvc": {"exploitation": "poc", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-71362", "publisher": "Adobe Systems Incorporated", "title": "Adobe Commerce and Magento Incorrect Authorization Vulnerability ", "summary": "Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.", "cvss": 9.1, "sev": "CRITICAL", "epss": 0.87507, "kev": true, "added": "2026-08-11", "pub": "2026-08-11T18:18:21.610", "modified": "2026-09-25T12:53:15.757", "products": [{"name": "commerce", "vendor": "adobe", "type": "app", "affected": ["< 2.4.4", "2.4.4", "2.4.4 p1", "2.4.4 p10", "2.4.4 p11", "2.4.4 p12", "2.4.4 p13", "2.4.4 p14"], "fixed": "2.4.4", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy commerce || rpm -q commerce || commerce --version"}, {"label": "2. UPGRADE to 2.4.4 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade commerce"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade commerce"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}, {"name": "commerce b2b", "vendor": "adobe", "type": "app", "affected": ["< 1.3.3", "1.3.3", "1.3.3 p1", "1.3.3 p10", "1.3.3 p11", "1.3.3 p12", "1.3.3 p13", "1.3.3 p14"], "fixed": "1.3.3", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy commerce-b2b || rpm -q commerce-b2b || commerce-b2b --version"}, {"label": "2. UPGRADE to 1.3.3 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade commerce-b2b"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade commerce-b2b"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}, {"name": "magento", "vendor": "adobe", "type": "app", "affected": ["<= 2.4.6", "2.4.7", "2.4.7 b1", "2.4.7 b2", "2.4.7 beta3", "2.4.7 p1", "2.4.7 p10", "2.4.7 p2"], "fixed": "newer than 2.4.6", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy magento || rpm -q magento || magento --version"}, {"label": "2. UPGRADE to newer than 2.4.6 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade magento"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade magento"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-71362"}, {"t": "Vendor Advisory", "u": "https://helpx.adobe.com/security/products/magento/apsb26-92.html"}], "cwe": ["CWE-863"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-09-27", "kev_added": "2026-09-24", "ransom": false, "priority": 95, "tier": "P0", "why": ["Critical severity", "EPSS top 1%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.9976, "pocs": [{"kind": "poc", "name": "dinosn/cve-2026-71362-magento-lab (5 stars)", "url": "https://github.com/dinosn/cve-2026-71362-magento-lab", "stars": 5}, {"kind": "poc", "name": "mahumadad/cve-2026-71362-magento-ato (0 stars)", "url": "https://github.com/mahumadad/cve-2026-71362-magento-ato", "stars": 0}, {"kind": "nuclei", "name": "Adobe Commerce/Magento - Customer Session Identity Switch", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-71362.yaml"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true}, {"id": "CVE-2026-65660", "publisher": "Microsoft Corporation", "title": "Microsoft SharePoint Code Injection Vulnerability", "summary": "Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.", "cvss": 8.8, "sev": "HIGH", "epss": 0.02101, "kev": true, "added": "2026-08-11", "pub": "2026-08-11T17:18:54.080", "modified": "2026-09-26T04:17:45.630", "products": [{"name": "sharepoint server", "vendor": "microsoft", "type": "app", "affected": ["< 16.0.19725.20522", "2016", "2019"], "fixed": "16.0.19725.20522", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy sharepoint-server || rpm -q sharepoint-server || sharepoint-server --version"}, {"label": "2. UPGRADE to 16.0.19725.20522 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade sharepoint-server"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade sharepoint-server"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-65660"}, {"t": "Patch, Vendor Advisory", "u": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660"}], "cwe": ["CWE-94"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": "2026-09-28", "kev_added": "2026-09-25", "ransom": false, "priority": 81, "tier": "P0", "why": ["High severity", "Exploited in the wild (CISA KEV)", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.81581, "pinned": false, "pocs": [{"kind": "poc", "name": "ShadowForge-Cyber/CVE-2026-65660-Poc (1 stars)", "url": "https://github.com/ShadowForge-Cyber/CVE-2026-65660-Poc", "stars": 1}, {"kind": "poc", "name": "HORKimhab/CVE-2026-65660 (0 stars)", "url": "https://github.com/HORKimhab/CVE-2026-65660", "stars": 0}], "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}, {"os": "Microsoft SharePoint Enterprise Server 2016", "pkg": "KB5002905", "status": "fixed", "fixed": "16.0.5565.1001", "cmd": "Install KB5002905 via Windows Update, then verify:\nGet-HotFix -Id KB5002905", "url": "https://www.microsoft.com/en-us/download/details.aspx?id=108758", "note": "KB5002905"}, {"os": "Microsoft SharePoint Enterprise Server 2016", "pkg": "KB5002906", "status": "fixed", "fixed": "16.0.5565.1001", "cmd": "Install KB5002906 via Windows Update, then verify:\nGet-HotFix -Id KB5002906", "url": "https://www.microsoft.com/en-us/download/details.aspx?id=108776", "note": "KB5002906"}, {"os": "Microsoft SharePoint Server 2019", "pkg": "KB5002894", "status": "fixed", "fixed": "16.0.10417.20198", "cmd": "Install KB5002894 via Windows Update, then verify:\nGet-HotFix -Id KB5002894", "url": "https://www.microsoft.com/en-us/download/details.aspx?id=108774", "note": "KB5002894"}, {"os": "Microsoft SharePoint Server 2019", "pkg": "KB5002896", "status": "fixed", "fixed": "16.0.10417.20198", "cmd": "Install KB5002896 via Windows Update, then verify:\nGet-HotFix -Id KB5002896", "url": "https://www.microsoft.com/en-us/download/details.aspx?id=108773", "note": "KB5002896"}, {"os": "Microsoft SharePoint Server Subscription Edition", "pkg": "KB5002893", "status": "fixed", "fixed": "16.0.19725.20522", "cmd": "Install KB5002893 via Windows Update, then verify:\nGet-HotFix -Id KB5002893", "url": "https://www.microsoft.com/en-us/download/details.aspx?id=108767", "note": "KB5002893"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true}, {"id": "CVE-2026-59124", "publisher": "Microsoft Corporation", "title": "Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized at", "summary": "Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.01532, "kev": false, "added": "2026-08-11", "pub": "2026-08-11T17:18:06.287", "modified": "2026-10-23T19:10:00.167", "products": [{"name": "windows app", "vendor": "microsoft", "type": "app", "affected": ["< 2.0.1314.0"], "fixed": "2.0.1314.0", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy windows-app || rpm -q windows-app || windows-app --version"}, {"label": "2. UPGRADE to 2.0.1314.0 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade windows-app"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade windows-app"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-59124"}, {"t": "Vendor Advisory", "u": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59124"}], "cwe": ["CWE-502"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 66, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.74605, "vendors": [{"os": "Fedora 46", "pkg": "diffoscope", "status": "fixed", "fixed": "335-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-e4c4cc0856", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-e4c4cc0856", "note": "FEDORA-2026-e4c4cc0856"}], "vendors_checked": "2026-10-23T19:12:48.430812+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-12571", "publisher": "ManageEngine", "title": "An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.", "summary": "An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.03272, "kev": false, "added": "2026-08-11", "pub": "2026-08-11T17:17:46.940", "modified": "2026-10-23T19:10:00.167", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-12571"}], "cwe": ["CWE-287", "CWE-640"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 64, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.88354, "vendors": [{"os": "Fedora 46", "pkg": "diffoscope", "status": "fixed", "fixed": "335-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-e4c4cc0856", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-e4c4cc0856", "note": "FEDORA-2026-e4c4cc0856"}], "vendors_checked": "2026-10-23T19:12:48.430812+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-72590", "publisher": "TuranSec", "title": "An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remot", "summary": "An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the env_vars parameter.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.02043, "kev": false, "added": "2026-08-10", "pub": "2026-08-10T11:17:32.123", "modified": "2026-10-23T20:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-72590"}], "cwe": ["CWE-93"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 63, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.8102, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-55799", "publisher": "Apache Software Foundation", "title": "Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0\nUsers are recommende", "summary": "Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0\nUsers are recommended to upgrade to version 2.9.0, which fixes this issue.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.01216, "kev": false, "added": "2026-08-10", "pub": "2026-08-10T11:17:26.670", "modified": "2026-10-23T20:10:00.160", "products": [{"name": "ranger", "vendor": "apache", "type": "app", "affected": ["< 2.9.0"], "fixed": "2.9.0", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy ranger || rpm -q ranger || ranger --version"}, {"label": "2. UPGRADE to 2.9.0 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade ranger"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade ranger"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-55799"}, {"t": "Mailing List, Vendor Advisory", "u": "https://lists.apache.org/thread/mqpdrqrvd47x5vhy03xok4ylbo9wbqgj"}], "cwe": ["CWE-94"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 64, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.6838, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-44416", "publisher": "Apache Software Foundation", "title": "Remote Code Execution via Arbitrary Class Instantiation in\u00a0plugin-schema-registry\u00a0component in Apache Ranger <", "summary": "Remote Code Execution via Arbitrary Class Instantiation in\u00a0plugin-schema-registry\u00a0component in Apache Ranger <= 2.8.0.\nUsers are recommended to upgrade to version 2.9.0, which fixes this issue.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.01242, "kev": false, "added": "2026-08-10", "pub": "2026-08-10T11:17:26.547", "modified": "2026-10-23T20:10:00.160", "products": [{"name": "ranger", "vendor": "apache", "type": "app", "affected": ["< 2.9.0"], "fixed": "2.9.0", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy ranger || rpm -q ranger || ranger --version"}, {"label": "2. UPGRADE to 2.9.0 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade ranger"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade ranger"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-44416"}, {"t": "Mailing List, Vendor Advisory", "u": "https://lists.apache.org/thread/2gqssqhwkzbpd8jx8q6986cwldr7qkdn"}], "cwe": ["CWE-94", "CWE-470"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 65, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.69005, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-42537", "publisher": "Apache Software Foundation", "title": "Remote Code Execution via JDBC URL Injection\u00a0in Apache Ranger <= 2.8.0\nUsers are recommended to upgrade to ver", "summary": "Remote Code Execution via JDBC URL Injection\u00a0in Apache Ranger <= 2.8.0\nUsers are recommended to upgrade to version 2.9.0, which fixes this issue.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.01289, "kev": false, "added": "2026-08-10", "pub": "2026-08-10T11:17:26.420", "modified": "2026-10-23T20:10:00.160", "products": [{"name": "ranger", "vendor": "apache", "type": "app", "affected": ["< 2.9.0"], "fixed": "2.9.0", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy ranger || rpm -q ranger || ranger --version"}, {"label": "2. UPGRADE to 2.9.0 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade ranger"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade ranger"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-42537"}, {"t": "Mailing List, Vendor Advisory", "u": "https://lists.apache.org/thread/ymwvz8cwv3wm8fq21pnd7fco0l1m4wrp"}], "cwe": ["CWE-20", "CWE-94"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 65, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.70014, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-28672", "publisher": "Apache Software Foundation", "title": "Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ra", "summary": "Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger.\n\nThis issue affects Apache Ranger: from 0.6 through 2.8.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.02631, "kev": false, "added": "2026-08-10", "pub": "2026-08-10T11:17:25.190", "modified": "2026-10-23T20:10:00.160", "products": [{"name": "ranger", "vendor": "apache", "type": "app", "affected": [">= 0.6.0 and <= 2.8.0"], "fixed": "newer than 2.8.0", "safe": "before 0.6.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy ranger || rpm -q ranger || ranger --version"}, {"label": "2. UPGRADE to newer than 2.8.0 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade ranger"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade ranger"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 0.6.0 (Debian / Ubuntu)", "cmd": "apt-cache madison ranger\nsudo apt install ranger=<VERSION_BEFORE_0.6.0>\nsudo apt-mark hold ranger"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list ranger\nsudo dnf downgrade ranger-<VERSION_BEFORE_0.6.0>\nsudo dnf versionlock add ranger"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-28672"}, {"t": "Mailing List, Vendor Advisory", "u": "https://lists.apache.org/thread/99ysjqcmz950o3jgm6pqx1wb696onzq7"}], "cwe": ["CWE-77"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 69, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.85422, "vendors": [{"os": "Maven", "pkg": "org.apache.ranger:ranger", "status": "vulnerable", "fixed": null, "cmd": null, "url": "https://github.com/advisories/GHSA-6qc3-v8fv-fv9j", "note": "vulnerable: >= 0.6.0, <= 2.8.0"}, {"os": "Fedora 46", "pkg": "kwin-zones", "status": "fixed", "fixed": "1.0.13-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-95888f332b", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-95888f332b", "note": "FEDORA-2026-95888f332b"}, {"os": "Fedora ELN", "pkg": "nginx-mod-brotli", "status": "fixed", "fixed": "1.0.0~rc-16.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-501a6a8273", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-501a6a8273", "note": "FEDORA-2026-501a6a8273"}], "vendors_checked": "2026-10-24T10:53:38.235670+00:00", "vendor_fixed": true, "pocs": [{"kind": "poc", "name": "oscerd/CVE-2026-28672 (0 stars)", "url": "https://github.com/oscerd/CVE-2026-28672", "stars": 0}], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-19348", "publisher": "VulDB", "title": "A security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a", "summary": "A security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a. Impacted is the function sprintf of the file /protocol.csp?fname=net&opt=smacfilter_conf&function=set&act=add&name=test&enable=1. Performing a manipulation of the argument enable/name/mac results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.03568, "kev": false, "added": "2026-08-09", "pub": "2026-08-09T11:16:52.743", "modified": "2026-10-23T20:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-19348"}], "cwe": ["CWE-74", "CWE-77"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 68, "tier": "P1", "why": ["Critical severity", "CISA SSVC: public proof of concept", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.89311, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [{"kind": "writeup", "name": "github.com/IEATASICS/m300-repeater-bugs", "url": "https://github.com/IEATASICS/m300-repeater-bugs"}], "ssvc": {"exploitation": "poc", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-71993", "publisher": "VulnCheck", "title": "MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the openvpn fu", "summary": "MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the openvpn function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the macfilter function to inject malicious commands and obtain root privileges on the underlying system.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.02464, "kev": false, "added": "2026-08-09", "pub": "2026-08-09T00:16:48.550", "modified": "2026-10-23T20:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-71993"}], "cwe": ["CWE-78"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 63, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.84354, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-71992", "publisher": "VulnCheck", "title": "MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the macfilter ", "summary": "MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the macfilter function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the macfilter function to inject malicious commands and obtain root privileges on the underlying system.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.02464, "kev": false, "added": "2026-08-09", "pub": "2026-08-09T00:16:48.410", "modified": "2026-10-23T20:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-71992"}], "cwe": ["CWE-78"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 63, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.84357, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-71991", "publisher": "VulnCheck", "title": "MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH ", "summary": "MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for Telnet configuration that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the Telnet configuration interface to inject malicious commands and obtain root privileges on the underlying system.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.02464, "kev": false, "added": "2026-08-09", "pub": "2026-08-09T00:16:48.270", "modified": "2026-10-23T20:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-71991"}], "cwe": ["CWE-78"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 63, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.84356, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-71990", "publisher": "VulnCheck", "title": "MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH ", "summary": "MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for SSH configuration that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the SSH configuration interface to inject malicious commands and obtain root privileges on the underlying system.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.02464, "kev": false, "added": "2026-08-09", "pub": "2026-08-09T00:16:48.130", "modified": "2026-10-23T20:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-71990"}], "cwe": ["CWE-78"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 63, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.84356, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-71989", "publisher": "VulnCheck", "title": "MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the porTrigger", "summary": "MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the porTrigger function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious commands and obtain root privileges on the underlying system.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.02464, "kev": false, "added": "2026-08-09", "pub": "2026-08-09T00:16:47.953", "modified": "2026-10-23T20:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-71989"}], "cwe": ["CWE-78"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 63, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.84356, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-71988", "publisher": "VulnCheck", "title": "MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the portFw fun", "summary": "MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the portFw function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious commands and obtain root privileges on the underlying system.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.02464, "kev": false, "added": "2026-08-09", "pub": "2026-08-09T00:16:47.780", "modified": "2026-10-23T20:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-71988"}], "cwe": ["CWE-78"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 63, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.84356, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-71987", "publisher": "VulnCheck", "title": "MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the alg functi", "summary": "MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the alg function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious commands and obtain root privileges on the underlying system.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.02464, "kev": false, "added": "2026-08-09", "pub": "2026-08-09T00:16:47.637", "modified": "2026-10-23T20:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-71987"}], "cwe": ["CWE-78"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 63, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.84357, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-71986", "publisher": "VulnCheck", "title": "MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the dmz functi", "summary": "MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the dmz function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the dmz function to execute malicious commands and obtain root privileges on the underlying system.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.02464, "kev": false, "added": "2026-08-09", "pub": "2026-08-09T00:16:47.500", "modified": "2026-10-23T20:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-71986"}], "cwe": ["CWE-78"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 63, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.84355, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-71985", "publisher": "VulnCheck", "title": "MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the accesscont", "summary": "MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the accesscontrol function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the accesscontrol function to execute malicious commands and obtain root privileges on the underlying system.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.02464, "kev": false, "added": "2026-08-09", "pub": "2026-08-09T00:16:47.360", "modified": "2026-10-23T20:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-71985"}], "cwe": ["CWE-78"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 63, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.84355, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-71984", "publisher": "VulnCheck", "title": "MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the urlfilter ", "summary": "MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the urlfilter function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the urlfilter function to inject malicious commands and obtain root privileges on the underlying system.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.02464, "kev": false, "added": "2026-08-09", "pub": "2026-08-09T00:16:47.207", "modified": "2026-10-23T20:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-71984"}], "cwe": ["CWE-78"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 63, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.84355, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-71983", "publisher": "VulnCheck", "title": "MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the wps.cgi in", "summary": "MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the wps.cgi interface that allows remote attackers to execute arbitrary commands by injecting malicious input through the pin2g, pin5g, or pin6g parameters. Attackers can exploit these unsanitized parameters to execute arbitrary commands on the affected device and obtain root privileges.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.02464, "kev": false, "added": "2026-08-08", "pub": "2026-08-08T23:16:56.967", "modified": "2026-10-23T20:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-71983"}], "cwe": ["CWE-78"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 63, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.84354, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-71955", "publisher": "VulnCheck", "title": "D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command ", "summary": "D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the /boafrm/formWsc interface. A remote attacker can inject arbitrary malicious commands into the localPin, targetAPSsid, peerPin, and peerRptPin fields, resulting in command execution with root privileges.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.03168, "kev": false, "added": "2026-08-08", "pub": "2026-08-08T17:16:49.250", "modified": "2026-10-23T20:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-71955"}], "cwe": ["CWE-78"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 64, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.87932, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-71954", "publisher": "VulnCheck", "title": "D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c", "summary": "D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary malicious commands into the tunnelid and sessionid fields, resulting in command execution with root privileges.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.03168, "kev": false, "added": "2026-08-08", "pub": "2026-08-08T17:16:49.097", "modified": "2026-10-23T20:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-71954"}], "cwe": ["CWE-78"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 64, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.87934, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-71952", "publisher": "VulnCheck", "title": "D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c", "summary": "D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formPinManageSetup interface. A remote attacker can inject arbitrary malicious commands into the oldPIn field, resulting in command execution with root privileges.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.03168, "kev": false, "added": "2026-08-08", "pub": "2026-08-08T17:16:48.733", "modified": "2026-10-23T20:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-71952"}], "cwe": ["CWE-78"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 64, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.87934, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-71951", "publisher": "VulnCheck", "title": "D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c", "summary": "D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEI_value field, resulting in command execution with root privileges.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.03168, "kev": false, "added": "2026-08-08", "pub": "2026-08-08T17:16:48.570", "modified": "2026-10-23T20:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-71951"}], "cwe": ["CWE-78"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 64, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.87933, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-71950", "publisher": "VulnCheck", "title": "D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c", "summary": "D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formSmsManage interface. A remote attacker can inject arbitrary malicious commands into the action_value field, resulting in command execution with root privileges.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.03168, "kev": false, "added": "2026-08-08", "pub": "2026-08-08T17:16:48.413", "modified": "2026-10-23T20:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-71950"}], "cwe": ["CWE-78"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 64, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.87933, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-71949", "publisher": "VulnCheck", "title": "D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c", "summary": "D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formUSSDSetup interface. A remote attacker can inject arbitrary malicious commands into the ussdValue and selectMenuValue fields, resulting in command execution with root privileges.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.03168, "kev": false, "added": "2026-08-08", "pub": "2026-08-08T17:16:48.267", "modified": "2026-10-23T20:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-71949"}], "cwe": ["CWE-78"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 64, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.87933, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-71947", "publisher": "VulnCheck", "title": "D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c", "summary": "D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formTracerouteDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host and ipVer fields, resulting in command execution with root privileges.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.03168, "kev": false, "added": "2026-08-08", "pub": "2026-08-08T17:16:47.983", "modified": "2026-10-23T20:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-71947"}], "cwe": ["CWE-78"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 64, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.87931, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-71946", "publisher": "VulnCheck", "title": "D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c", "summary": "D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution with root privileges.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.03168, "kev": false, "added": "2026-08-08", "pub": "2026-08-08T17:16:47.847", "modified": "2026-10-23T20:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-71946"}], "cwe": ["CWE-78"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 64, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.87932, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-71945", "publisher": "VulnCheck", "title": "D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a c", "summary": "D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface. A remote attacker can inject arbitrary malicious commands into the fota_url field, resulting in command execution with root privileges.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.03168, "kev": false, "added": "2026-08-08", "pub": "2026-08-08T17:16:47.710", "modified": "2026-10-23T20:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-71945"}], "cwe": ["CWE-78"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 64, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.87935, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-61808", "publisher": "GitHub, Inc.", "title": "LightRAG provides simple and fast retrieval-augmented generation", "summary": "LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modify the knowledge graph, cancel pipelines, clear caches, and consume LLM resources. This issue is mitigated in version 1.5.5rc1.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.02497, "kev": false, "added": "2026-08-07", "pub": "2026-08-07T20:16:52.007", "modified": "2026-10-23T20:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-61808"}], "cwe": ["CWE-306"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 66, "tier": "P1", "why": ["Critical severity", "CISA SSVC: public proof of concept", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.84578, "vendors": [{"os": "Fedora 46", "pkg": "clementine", "status": "fixed", "fixed": "1.4.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e748ef4d3", "note": "FEDORA-2026-3e748ef4d3"}], "vendors_checked": "2026-10-23T20:12:34.908944+00:00", "vendor_fixed": true, "pocs": [{"kind": "writeup", "name": "github.com/HKUDS/LightRAG/security/advisories/GHSA-mmg5-8x8q-v934", "url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-mmg5-8x8q-v934"}, {"kind": "nuclei", "name": "LightRAG <= 1.5.4 - Missing Authentication", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-61808.yaml"}], "ssvc": {"exploitation": "poc", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-71558", "publisher": "Apache Software Foundation", "title": "Heap type confusion vulnerability in Apache Fory C++ deserialization.\n\nThis issue affects Apache Fory C++ vers", "summary": "Heap type confusion vulnerability in Apache Fory C++ deserialization.\n\nThis issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution.\n\n\nUser", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.0099, "kev": false, "added": "2026-08-07", "pub": "2026-08-07T10:16:59.337", "modified": "2026-10-23T21:10:00.157", "products": [{"name": "fory", "vendor": "apache", "type": "app", "affected": [">= 0.14.0 and < 1.5.0"], "fixed": "1.5.0", "safe": "before 0.14.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy fory || rpm -q fory || fory --version"}, {"label": "2. UPGRADE to 1.5.0 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade fory"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade fory"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 0.14.0 (Debian / Ubuntu)", "cmd": "apt-cache madison fory\nsudo apt install fory=<VERSION_BEFORE_0.14.0>\nsudo apt-mark hold fory"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list fory\nsudo dnf downgrade fory-<VERSION_BEFORE_0.14.0>\nsudo dnf versionlock add fory"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-71558"}, {"t": "Mailing List, Vendor Advisory", "u": "https://lists.apache.org/thread/oywndv60jwqdv6j37t7bc1qbcc4b235r"}], "cwe": ["CWE-502", "CWE-843"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 63, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.62203, "vendors": [{"os": "Fedora 46", "pkg": "pspp", "status": "fixed", "fixed": "2.1.3-2.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0d6444911b", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d6444911b", "note": "FEDORA-2026-0d6444911b"}, {"os": "Fedora ELN", "pkg": "barman", "status": "fixed", "fixed": "3.20.1-3.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-45ecf042c2", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ecf042c2", "note": "FEDORA-2026-45ecf042c2"}], "vendors_checked": "2026-10-23T23:09:01.822238+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-56162", "publisher": "Microsoft Corporation", "title": "Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a net", "summary": "Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.", "cvss": 10.0, "sev": "CRITICAL", "epss": 0.00901, "kev": false, "added": "2026-08-07", "pub": "2026-08-07T00:16:31.990", "modified": "2026-10-23T21:10:00.157", "products": [{"name": "azure sql database", "vendor": "microsoft", "type": "app", "affected": ["all versions"], "fixed": null, "safe": null, "action": "mitigate", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy azure-sql-database || rpm -q azure-sql-database || azure-sql-database --version"}, {"label": "No fixed or unaffected release known", "cmd": "Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-56162"}, {"t": "Vendor Advisory", "u": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56162"}], "cwe": ["CWE-287"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 63, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.59342, "vendors": [{"os": "Fedora 46", "pkg": "pspp", "status": "fixed", "fixed": "2.1.3-2.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0d6444911b", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d6444911b", "note": "FEDORA-2026-0d6444911b"}, {"os": "Fedora ELN", "pkg": "barman", "status": "fixed", "fixed": "3.20.1-3.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-45ecf042c2", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ecf042c2", "note": "FEDORA-2026-45ecf042c2"}], "vendors_checked": "2026-10-23T23:09:01.822238+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-65400", "publisher": "Apple Inc.", "title": "Apple macOS Improper Authentication Vulnerability", "summary": "An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.01723, "kev": true, "added": "2026-08-06", "pub": "2026-08-06T22:18:14.533", "modified": "2026-10-23T21:10:00.157", "products": [{"name": "macos", "vendor": "apple", "type": "os", "affected": [">= 14.0 and < 14.8.9", ">= 15.0 and < 15.7.9", ">= 26.0 and < 26.6.1"], "fixed": "14.8.9, 15.7.9, 26.6.1", "safe": "before 14.0", "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-65400"}, {"t": "Release Notes, Vendor Advisory", "u": "https://support.apple.com/en-us/148170"}, {"t": "Release Notes, Vendor Advisory", "u": "https://support.apple.com/en-us/148171"}, {"t": "Release Notes, Vendor Advisory", "u": "https://support.apple.com/en-us/148172"}, {"t": "Release Notes, Vendor Advisory", "u": "https://support.apple.com/en-us/149035"}, {"t": "Release Notes, Vendor Advisory", "u": "https://support.apple.com/en-us/149042"}], "cwe": ["CWE-287"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": "2026-08-21", "kev_added": "2026-08-18", "ransom": false, "priority": 87, "tier": "P0", "why": ["Critical severity", "Exploited in the wild (CISA KEV)", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.77346, "vendors": [{"os": "Fedora 46", "pkg": "pspp", "status": "fixed", "fixed": "2.1.3-2.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0d6444911b", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d6444911b", "note": "FEDORA-2026-0d6444911b"}, {"os": "Fedora ELN", "pkg": "barman", "status": "fixed", "fixed": "3.20.1-3.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-45ecf042c2", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ecf042c2", "note": "FEDORA-2026-45ecf042c2"}], "vendors_checked": "2026-10-23T23:09:01.822238+00:00", "vendor_fixed": true, "pocs": [{"kind": "poc", "name": "panchocosil/CVE-2026-65400-poc (9 stars)", "url": "https://github.com/panchocosil/CVE-2026-65400-poc", "stars": 9}, {"kind": "poc", "name": "acheong08/CVE-2026-65400 (9 stars)", "url": "https://github.com/acheong08/CVE-2026-65400", "stars": 9}, {"kind": "poc", "name": "HORKimhab/CVE-2026-65400 (3 stars)", "url": "https://github.com/HORKimhab/CVE-2026-65400", "stars": 3}, {"kind": "writeup", "name": "advisories.ncsc.nl/2026/ncsc-2026-0280.html", "url": "https://advisories.ncsc.nl/2026/ncsc-2026-0280.html"}], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "pinned": false, "mentions": [{"src": "Huntress", "group": "research", "title": "From Screen Share to Root Access: Breaking Down CVE-2026-43760 and CVE-2026-65400 on macOS", "url": "https://www.huntress.com/blog/macos-screen-sharing-rce-patched", "date": "2026-08-07"}], "buzz": 1}, {"id": "CVE-2026-67261", "publisher": "Dell", "title": "Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Comma", "summary": "Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying operating system with root privileges. Exploitation may lead to a complete system takeover by an attacker. This vulnerability is", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.02319, "kev": false, "added": "2026-08-06", "pub": "2026-08-06T15:17:24.430", "modified": "2026-10-23T21:10:00.157", "products": [{"name": "virtual storage integrator", "vendor": "dell", "type": "app", "affected": ["< 10.11.1.0"], "fixed": "10.11.1.0", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy virtual-storage-integrator || rpm -q virtual-storage-integrator || virtual-storage-integrator --version"}, {"label": "2. UPGRADE to 10.11.1.0 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade virtual-storage-integrator"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade virtual-storage-integrator"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-67261"}, {"t": "Vendor Advisory", "u": "https://www.dell.com/support/kbdoc/en-us/000496035/dsa-2026-335-security-update-for-dell-virtual-storage-integrator-for-vmware-vsphere-client-multiple-vulnerabilities"}], "cwe": ["CWE-78"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 63, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.83329, "vendors": [{"os": "Fedora 46", "pkg": "pspp", "status": "fixed", "fixed": "2.1.3-2.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0d6444911b", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d6444911b", "note": "FEDORA-2026-0d6444911b"}, {"os": "Fedora ELN", "pkg": "barman", "status": "fixed", "fixed": "3.20.1-3.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-45ecf042c2", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ecf042c2", "note": "FEDORA-2026-45ecf042c2"}], "vendors_checked": "2026-10-23T23:09:01.822238+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-66909", "publisher": "Apache Software Foundation", "title": "Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage\u00a0using native Java deserializ", "summary": "Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage\u00a0using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage\u00a0deserialization by default, with a configuration s", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.01148, "kev": false, "added": "2026-08-06", "pub": "2026-08-06T11:16:30.583", "modified": "2026-10-23T21:10:00.157", "products": [{"name": "cxf", "vendor": "apache", "type": "app", "affected": ["< 3.6.12", ">= 4.0.0 and < 4.1.8", ">= 4.2.0 and < 4.2.3"], "fixed": "3.6.12, 4.1.8, 4.2.3", "safe": "before 4.0.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy cxf || rpm -q cxf || cxf --version"}, {"label": "2. UPGRADE to 3.6.12 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade cxf"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade cxf"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 4.0.0 (Debian / Ubuntu)", "cmd": "apt-cache madison cxf\nsudo apt install cxf=<VERSION_BEFORE_4.0.0>\nsudo apt-mark hold cxf"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list cxf\nsudo dnf downgrade cxf-<VERSION_BEFORE_4.0.0>\nsudo dnf versionlock add cxf"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-66909"}, {"t": "Mailing List, Vendor Advisory", "u": "https://lists.apache.org/thread/lr5d4tg6tf7j29jmw8wt242oowonjqpx"}], "cwe": ["CWE-502"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 64, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.666, "vendors": [{"os": "Fedora 46", "pkg": "pspp", "status": "fixed", "fixed": "2.1.3-2.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0d6444911b", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d6444911b", "note": "FEDORA-2026-0d6444911b"}, {"os": "Fedora ELN", "pkg": "barman", "status": "fixed", "fixed": "3.20.1-3.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-45ecf042c2", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ecf042c2", "note": "FEDORA-2026-45ecf042c2"}], "vendors_checked": "2026-10-23T23:09:01.822238+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-5430", "publisher": "WSO2 LLC", "title": "WSO2 Multiple Products Path Traversal Vulnerability ", "summary": "The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.\n\nSuccessful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. Th", "cvss": 10.0, "sev": "CRITICAL", "epss": 0.00588, "kev": true, "added": "2026-08-06", "pub": "2026-08-06T08:16:33.240", "modified": "2026-09-25T12:53:05.517", "products": [{"name": "api control plane", "vendor": "wso2", "type": "app", "affected": [">= 4.5.0 and < 4.5.0.58", ">= 4.6.0 and < 4.6.0.22"], "fixed": "4.5.0.58, 4.6.0.22", "safe": "before 4.5.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy api-control-plane || rpm -q api-control-plane || api-control-plane --version"}, {"label": "2. UPGRADE to 4.5.0.58 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade api-control-plane"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade api-control-plane"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 4.5.0 (Debian / Ubuntu)", "cmd": "apt-cache madison api-control-plane\nsudo apt install api-control-plane=<VERSION_BEFORE_4.5.0>\nsudo apt-mark hold api-control-plane"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list api-control-plane\nsudo dnf downgrade api-control-plane-<VERSION_BEFORE_4.5.0>\nsudo dnf versionlock add api-control-plane"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "api manager", "vendor": "wso2", "type": "app", "affected": [">= 4.1.0 and < 4.1.0.257", ">= 4.2.0 and < 4.2.0.197", ">= 4.3.0 and < 4.3.0.108", ">= 4.4.0 and < 4.4.0.72", ">= 4.5.0 and < 4.5.0.57", ">= 4.6.0 and < 4.6.0.21"], "fixed": "4.1.0.257, 4.2.0.197, 4.3.0.108, 4.4.0.72, 4.5.0.57, 4.6.0.21", "safe": "before 4.1.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy api-manager || rpm -q api-manager || api-manager --version"}, {"label": "2. UPGRADE to 4.1.0.257 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade api-manager"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade api-manager"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 4.1.0 (Debian / Ubuntu)", "cmd": "apt-cache madison api-manager\nsudo apt install api-manager=<VERSION_BEFORE_4.1.0>\nsudo apt-mark hold api-manager"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list api-manager\nsudo dnf downgrade api-manager-<VERSION_BEFORE_4.1.0>\nsudo dnf versionlock add api-manager"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "traffic manager", "vendor": "wso2", "type": "app", "affected": [">= 4.5.0 and < 4.5.0.56", ">= 4.6.0 and < 4.6.0.21"], "fixed": "4.5.0.56, 4.6.0.21", "safe": "before 4.5.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy traffic-manager || rpm -q traffic-manager || traffic-manager --version"}, {"label": "2. UPGRADE to 4.5.0.56 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade traffic-manager"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade traffic-manager"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 4.5.0 (Debian / Ubuntu)", "cmd": "apt-cache madison traffic-manager\nsudo apt install traffic-manager=<VERSION_BEFORE_4.5.0>\nsudo apt-mark hold traffic-manager"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list traffic-manager\nsudo dnf downgrade traffic-manager-<VERSION_BEFORE_4.5.0>\nsudo dnf versionlock add traffic-manager"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "universal gateway", "vendor": "wso2", "type": "app", "affected": [">= 4.5.0 and < 4.5.0.57", ">= 4.6.0 and < 4.6.0.21"], "fixed": "4.5.0.57, 4.6.0.21", "safe": "before 4.5.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy universal-gateway || rpm -q universal-gateway || universal-gateway --version"}, {"label": "2. UPGRADE to 4.5.0.57 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade universal-gateway"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade universal-gateway"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 4.5.0 (Debian / Ubuntu)", "cmd": "apt-cache madison universal-gateway\nsudo apt install universal-gateway=<VERSION_BEFORE_4.5.0>\nsudo apt-mark hold universal-gateway"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list universal-gateway\nsudo dnf downgrade universal-gateway-<VERSION_BEFORE_4.5.0>\nsudo dnf versionlock add universal-gateway"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-5430"}, {"t": "Vendor Advisory", "u": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/"}], "cwe": ["CWE-347"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": "2026-09-27", "kev_added": "2026-09-24", "ransom": false, "priority": 80, "tier": "P0", "why": ["Critical severity", "Exploited in the wild (CISA KEV)", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.47448, "pinned": false, "pocs": [{"kind": "poc", "name": "abraxas/CVE-2026-5430 (2 stars)", "url": "https://github.com/abraxas/CVE-2026-5430", "stars": 2}, {"kind": "poc", "name": "davidvrns/CVE-2026-5430-WSO2 (1 stars)", "url": "https://github.com/davidvrns/CVE-2026-5430-WSO2", "stars": 1}, {"kind": "poc", "name": "HORKimhab/CVE-2026-5430 (0 stars)", "url": "https://github.com/HORKimhab/CVE-2026-5430", "stars": 0}], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true}, {"id": "CVE-2026-61515", "publisher": "VulnCheck", "title": "Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability", "summary": "Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567. Attackers can exploit the lack of authentication and input sanitization in the binary protocol service to pass arbitrary commands directly to the underlying operating system,", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.02438, "kev": false, "added": "2026-08-04", "pub": "2026-08-04T15:16:36.967", "modified": "2026-10-23T23:10:00.157", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-61515"}], "cwe": ["CWE-912"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 66, "tier": "P1", "why": ["Critical severity", "CISA SSVC: public proof of concept", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.8418, "pinned": false, "pocs": [], "ssvc": {"exploitation": "poc", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "python-openslide", "status": "fixed", "fixed": "1.4.7-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-336bea884e", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-336bea884e", "note": "FEDORA-2026-336bea884e"}, {"os": "Fedora ELN", "pkg": "valgrind", "status": "fixed", "fixed": "3.28.0-1.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-c593ef1d15", "note": "FEDORA-2026-c593ef1d15"}], "vendors_checked": "2026-10-24T04:31:13.918852+00:00", "vendor_fixed": true}, {"id": "CVE-2026-18686", "publisher": "VulDB", "title": "A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5", "summary": "A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function nas-web.add_user of the file /cgi-bin/glc of the component nas-web RPC Wrapper. Performing a manipulation results in command injection. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.04731, "kev": false, "added": "2026-08-04", "pub": "2026-08-04T00:16:40.520", "modified": "2026-10-23T23:10:00.157", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-18686"}], "cwe": ["CWE-74", "CWE-77"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 68, "tier": "P1", "why": ["Critical severity", "EPSS top 8%: very likely to be exploited", "CISA SSVC: public proof of concept", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.91819, "pinned": false, "pocs": [], "ssvc": {"exploitation": "poc", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "python-openslide", "status": "fixed", "fixed": "1.4.7-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-336bea884e", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-336bea884e", "note": "FEDORA-2026-336bea884e"}, {"os": "Fedora ELN", "pkg": "valgrind", "status": "fixed", "fixed": "3.28.0-1.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-c593ef1d15", "note": "FEDORA-2026-c593ef1d15"}], "vendors_checked": "2026-10-24T04:31:13.918852+00:00", "vendor_fixed": true}, {"id": "CVE-2026-18685", "publisher": "VulDB", "title": "A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5", "summary": "A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function set_upgrade of the file /cgi-bin/glc of the component modem.so. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.03616, "kev": false, "added": "2026-08-04", "pub": "2026-08-04T00:16:40.350", "modified": "2026-10-23T23:10:00.157", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-18685"}], "cwe": ["CWE-74", "CWE-77"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 68, "tier": "P1", "why": ["Critical severity", "CISA SSVC: public proof of concept", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.89461, "pinned": false, "pocs": [{"kind": "writeup", "name": "github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/modem_set_upgrade_glc_rce", "url": "https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/modem_set_upgrade_glc_rce"}], "ssvc": {"exploitation": "poc", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "python-openslide", "status": "fixed", "fixed": "1.4.7-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-336bea884e", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-336bea884e", "note": "FEDORA-2026-336bea884e"}, {"os": "Fedora ELN", "pkg": "valgrind", "status": "fixed", "fixed": "3.28.0-1.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-c593ef1d15", "note": "FEDORA-2026-c593ef1d15"}], "vendors_checked": "2026-10-24T04:31:13.918852+00:00", "vendor_fixed": true}, {"id": "CVE-2026-18684", "publisher": "VulDB", "title": "A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5", "summary": "A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. This issue affects the function remove_profile of the file /cgi-bin/glc of the component modem.so. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.03616, "kev": false, "added": "2026-08-03", "pub": "2026-08-03T23:16:45.750", "modified": "2026-10-23T21:10:00.157", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-18684"}], "cwe": ["CWE-74", "CWE-77"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 68, "tier": "P1", "why": ["Critical severity", "CISA SSVC: public proof of concept", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.89462, "vendors": [{"os": "Fedora 46", "pkg": "pspp", "status": "fixed", "fixed": "2.1.3-2.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0d6444911b", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d6444911b", "note": "FEDORA-2026-0d6444911b"}, {"os": "Fedora ELN", "pkg": "barman", "status": "fixed", "fixed": "3.20.1-3.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-45ecf042c2", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ecf042c2", "note": "FEDORA-2026-45ecf042c2"}], "vendors_checked": "2026-10-23T23:09:01.822238+00:00", "vendor_fixed": true, "pocs": [{"kind": "writeup", "name": "github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/modem_remove_profile_glc_rce", "url": "https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/modem_remove_profile_glc_rce"}], "ssvc": {"exploitation": "poc", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-18616", "publisher": "VulDB", "title": "A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5", "summary": "A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.set_peer of the file /cgi-bin/glc of the component wg-server.so Native Plugin. The manipulation of the argument public_key leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure and confirmed the existence of the vu", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.03616, "kev": false, "added": "2026-08-03", "pub": "2026-08-03T19:16:45.557", "modified": "2026-10-23T21:10:00.157", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-18616"}], "cwe": ["CWE-74", "CWE-77"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 68, "tier": "P1", "why": ["Critical severity", "CISA SSVC: public proof of concept", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.89461, "vendors": [{"os": "Fedora 46", "pkg": "pspp", "status": "fixed", "fixed": "2.1.3-2.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0d6444911b", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d6444911b", "note": "FEDORA-2026-0d6444911b"}, {"os": "Fedora ELN", "pkg": "barman", "status": "fixed", "fixed": "3.20.1-3.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-45ecf042c2", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ecf042c2", "note": "FEDORA-2026-45ecf042c2"}], "vendors_checked": "2026-10-23T23:09:01.822238+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "poc", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-18615", "publisher": "VulDB", "title": "A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5", "summary": "A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generate_publickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argument private_key can lead to command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and confirmed ", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.03616, "kev": false, "added": "2026-08-03", "pub": "2026-08-03T19:16:45.383", "modified": "2026-10-23T21:10:00.157", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-18615"}], "cwe": ["CWE-74", "CWE-77"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 68, "tier": "P1", "why": ["Critical severity", "CISA SSVC: public proof of concept", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.89461, "vendors": [{"os": "Fedora 46", "pkg": "pspp", "status": "fixed", "fixed": "2.1.3-2.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0d6444911b", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d6444911b", "note": "FEDORA-2026-0d6444911b"}, {"os": "Fedora ELN", "pkg": "barman", "status": "fixed", "fixed": "3.20.1-3.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-45ecf042c2", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ecf042c2", "note": "FEDORA-2026-45ecf042c2"}], "vendors_checked": "2026-10-23T23:09:01.822238+00:00", "vendor_fixed": true, "pocs": [{"kind": "writeup", "name": "vuldb.com/cve/CVE-2026-18615", "url": "https://vuldb.com/cve/CVE-2026-18615"}], "ssvc": {"exploitation": "poc", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-18614", "publisher": "VulDB", "title": "A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5", "summary": "A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo_server of the file /cgi-bin/glc of the component s2s.so Native Plugin. Performing a manipulation of the argument port results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.03616, "kev": false, "added": "2026-08-03", "pub": "2026-08-03T19:16:45.200", "modified": "2026-10-23T21:10:00.157", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-18614"}], "cwe": ["CWE-74", "CWE-77"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 68, "tier": "P1", "why": ["Critical severity", "CISA SSVC: public proof of concept", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.8946, "vendors": [{"os": "Fedora 46", "pkg": "pspp", "status": "fixed", "fixed": "2.1.3-2.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0d6444911b", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d6444911b", "note": "FEDORA-2026-0d6444911b"}, {"os": "Fedora ELN", "pkg": "barman", "status": "fixed", "fixed": "3.20.1-3.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-45ecf042c2", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ecf042c2", "note": "FEDORA-2026-45ecf042c2"}], "vendors_checked": "2026-10-23T23:09:01.822238+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "poc", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-18612", "publisher": "VulDB", "title": "A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5", "summary": "A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.remove_package/plugins.install_package of the file /cgi-bin/glc of the component plugins.so Native Plugin. This manipulation causes command injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.03967, "kev": false, "added": "2026-08-03", "pub": "2026-08-03T18:16:38.450", "modified": "2026-10-23T21:10:00.157", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-18612"}], "cwe": ["CWE-74", "CWE-77"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 68, "tier": "P1", "why": ["Critical severity", "EPSS top 10%: very likely to be exploited", "CISA SSVC: public proof of concept", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.90417, "vendors": [{"os": "Fedora 46", "pkg": "pspp", "status": "fixed", "fixed": "2.1.3-2.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0d6444911b", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d6444911b", "note": "FEDORA-2026-0d6444911b"}, {"os": "Fedora ELN", "pkg": "barman", "status": "fixed", "fixed": "3.20.1-3.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-45ecf042c2", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ecf042c2", "note": "FEDORA-2026-45ecf042c2"}], "vendors_checked": "2026-10-23T23:09:01.822238+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "poc", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-41452", "publisher": "VulnCheck", "title": "Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unaut", "summary": "Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall middleware redirect check. Attackers can supply arbitrary name, email, and password values to the admin-config-setup endpoint, which performs an unauthe", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.03742, "kev": false, "added": "2026-08-03", "pub": "2026-08-03T17:16:37.047", "modified": "2026-10-23T21:10:00.157", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-41452"}], "cwe": ["CWE-306"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 68, "tier": "P1", "why": ["Critical severity", "CISA SSVC: public proof of concept", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.89813, "vendors": [{"os": "Fedora 46", "pkg": "pspp", "status": "fixed", "fixed": "2.1.3-2.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0d6444911b", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d6444911b", "note": "FEDORA-2026-0d6444911b"}, {"os": "Fedora ELN", "pkg": "barman", "status": "fixed", "fixed": "3.20.1-3.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-45ecf042c2", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ecf042c2", "note": "FEDORA-2026-45ecf042c2"}], "vendors_checked": "2026-10-23T23:09:01.822238+00:00", "vendor_fixed": true, "pocs": [{"kind": "poc", "name": "Boreas37/CVE-2026-41452-PoC (4 stars)", "url": "https://github.com/Boreas37/CVE-2026-41452-PoC", "stars": 4}, {"kind": "poc", "name": "o-sec/CVE-2026-41452-poc (0 stars)", "url": "https://github.com/o-sec/CVE-2026-41452-poc", "stars": 0}, {"kind": "writeup", "name": "jivasecurity.com/writeups/krayin-installer-bypass-account-takeover-cve-2026-41452", "url": "https://jivasecurity.com/writeups/krayin-installer-bypass-account-takeover-cve-2026-41452"}, {"kind": "nuclei", "name": "Krayin CRM < 2.2.1 - Installer Authentication Bypass", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41452.yaml"}], "ssvc": {"exploitation": "poc", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-18602", "publisher": "VulDB", "title": "A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5", "summary": "A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.get_recommend_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Executing a manipulation of the argument Hostname can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and confirmed the exist", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.03616, "kev": false, "added": "2026-08-03", "pub": "2026-08-03T17:16:35.153", "modified": "2026-10-23T21:10:00.157", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-18602"}], "cwe": ["CWE-74", "CWE-77"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 68, "tier": "P1", "why": ["Critical severity", "CISA SSVC: public proof of concept", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.89461, "vendors": [{"os": "Fedora 46", "pkg": "pspp", "status": "fixed", "fixed": "2.1.3-2.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0d6444911b", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d6444911b", "note": "FEDORA-2026-0d6444911b"}, {"os": "Fedora ELN", "pkg": "barman", "status": "fixed", "fixed": "3.20.1-3.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-45ecf042c2", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ecf042c2", "note": "FEDORA-2026-45ecf042c2"}], "vendors_checked": "2026-10-23T23:09:01.822238+00:00", "vendor_fixed": true, "pocs": [{"kind": "writeup", "name": "github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/ovpn_get_recommend_config_glc_", "url": "https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/ovpn_get_recommend_config_glc_rce/CVE.md"}], "ssvc": {"exploitation": "poc", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-69085", "publisher": "VulnCheck", "title": "SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where th", "summary": "SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. Because the statement executes on a read-write SQLite handle via a driver th", "cvss": 10.0, "sev": "CRITICAL", "epss": 0.01488, "kev": false, "added": "2026-08-03", "pub": "2026-08-03T14:16:28.820", "modified": "2026-10-23T21:10:00.157", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-69085"}], "cwe": ["CWE-89"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 64, "tier": "P1", "why": ["Critical severity", "CISA SSVC: public proof of concept", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.73879, "vendors": [{"os": "Go", "pkg": "github.com/siyuan-note/siyuan/kernel", "status": "fixed", "fixed": "0.0.0-20260721043339-eef10568384e", "cmd": "go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260721043339-eef10568384e\ngo list -m github.com/siyuan-note/siyuan/kernel", "url": "https://github.com/advisories/GHSA-33jq-p8c2-q3q4", "note": "vulnerable: < 0.0.0-20260721043339-eef10568384e"}, {"os": "Fedora 46", "pkg": "pspp", "status": "fixed", "fixed": "2.1.3-2.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0d6444911b", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d6444911b", "note": "FEDORA-2026-0d6444911b"}, {"os": "Fedora ELN", "pkg": "barman", "status": "fixed", "fixed": "3.20.1-3.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-45ecf042c2", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ecf042c2", "note": "FEDORA-2026-45ecf042c2"}], "vendors_checked": "2026-10-23T23:09:01.822238+00:00", "vendor_fixed": true, "pocs": [{"kind": "nuclei", "name": "SiYuan <=3.7.2 - SQL Injection", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-69085.yaml"}], "ssvc": {"exploitation": "poc", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-69084", "publisher": "VulnCheck", "title": "SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL", "summary": "SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the publish RoleReader token and by anonymous users when publish authentication is disabled. Because the underlying driver executes stacked statements, an a", "cvss": 10.0, "sev": "CRITICAL", "epss": 0.01573, "kev": false, "added": "2026-08-03", "pub": "2026-08-03T14:16:28.680", "modified": "2026-10-23T21:10:00.157", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-69084"}], "cwe": ["CWE-89"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 65, "tier": "P1", "why": ["Critical severity", "CISA SSVC: public proof of concept", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.75238, "vendors": [{"os": "Go", "pkg": "github.com/siyuan-note/siyuan/kernel", "status": "fixed", "fixed": "0.0.0-20260721002947-23a17d44b5f3", "cmd": "go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260721002947-23a17d44b5f3\ngo list -m github.com/siyuan-note/siyuan/kernel", "url": "https://github.com/advisories/GHSA-vh22-h7hf-www7", "note": "vulnerable: < 0.0.0-20260721002947-23a17d44b5f3"}, {"os": "Fedora 46", "pkg": "pspp", "status": "fixed", "fixed": "2.1.3-2.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0d6444911b", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d6444911b", "note": "FEDORA-2026-0d6444911b"}, {"os": "Fedora ELN", "pkg": "barman", "status": "fixed", "fixed": "3.20.1-3.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-45ecf042c2", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ecf042c2", "note": "FEDORA-2026-45ecf042c2"}], "vendors_checked": "2026-10-23T23:09:01.822238+00:00", "vendor_fixed": true, "pocs": [{"kind": "poc", "name": "Boreas37/CVE-2026-69084-PoC (1 stars)", "url": "https://github.com/Boreas37/CVE-2026-69084-PoC", "stars": 1}, {"kind": "nuclei", "name": "SiYuan - SQL Execution", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-69084.yaml"}], "ssvc": {"exploitation": "poc", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-18601", "publisher": "VulDB", "title": "A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5", "summary": "A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Performing a manipulation of the argument filename results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and confirmed the existence of the", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.03616, "kev": false, "added": "2026-08-03", "pub": "2026-08-03T14:16:25.947", "modified": "2026-10-23T21:10:00.157", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-18601"}], "cwe": ["CWE-74", "CWE-77"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 68, "tier": "P1", "why": ["Critical severity", "CISA SSVC: public proof of concept", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.8946, "vendors": [{"os": "Fedora 46", "pkg": "pspp", "status": "fixed", "fixed": "2.1.3-2.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0d6444911b", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d6444911b", "note": "FEDORA-2026-0d6444911b"}, {"os": "Fedora ELN", "pkg": "barman", "status": "fixed", "fixed": "3.20.1-3.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-45ecf042c2", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ecf042c2", "note": "FEDORA-2026-45ecf042c2"}], "vendors_checked": "2026-10-23T23:09:01.822238+00:00", "vendor_fixed": true, "pocs": [{"kind": "writeup", "name": "github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/ovpn_check_config_glc_rce/CVE.", "url": "https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/ovpn_check_config_glc_rce/CVE.md"}], "ssvc": {"exploitation": "poc", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-18588", "publisher": "VulDB", "title": "A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628", "summary": "A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONTENT_LENGTH leads to stack-based buffer overflow. Remote exploitation of the attack is possible. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.01096, "kev": false, "added": "2026-08-03", "pub": "2026-08-03T07:16:43.047", "modified": "2026-10-23T22:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-18588"}], "cwe": ["CWE-119", "CWE-121"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 62, "tier": "P1", "why": ["Critical severity", "CISA SSVC: public proof of concept", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.65304, "vendors": [{"os": "Fedora 46", "pkg": "pspp", "status": "fixed", "fixed": "2.1.3-2.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0d6444911b", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d6444911b", "note": "FEDORA-2026-0d6444911b"}, {"os": "Fedora ELN", "pkg": "barman", "status": "fixed", "fixed": "3.20.1-3.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-45ecf042c2", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ecf042c2", "note": "FEDORA-2026-45ecf042c2"}], "vendors_checked": "2026-10-23T23:10:32.563403+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "poc", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-18577", "publisher": "N-able", "title": "N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability", "summary": "An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1", "cvss": 8.1, "sev": "HIGH", "epss": 0.14622, "kev": true, "added": "2026-08-02", "pub": "2026-08-02T23:16:26.210", "modified": "2026-10-23T22:10:00.160", "products": [{"name": "n-central", "vendor": "n-able", "type": "app", "affected": ["< 2026.3", "2026.3"], "fixed": "2026.3", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy n-central || rpm -q n-central || n-central --version"}, {"label": "2. UPGRADE to 2026.3 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade n-central"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade n-central"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-18577"}, {"t": "Patch, Release Notes", "u": "https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF1_Release_Notes.htm"}, {"t": "Vendor Advisory", "u": "https://www.n-able.com/blog/n-central-security-update-august-2-2026"}], "cwe": ["CWE-288"], "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": "2026-08-06", "kev_added": "2026-08-03", "ransom": false, "priority": 86, "tier": "P0", "why": ["High severity", "EPSS top 3%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.96656, "vendors": [{"os": "Fedora 46", "pkg": "pspp", "status": "fixed", "fixed": "2.1.3-2.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0d6444911b", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d6444911b", "note": "FEDORA-2026-0d6444911b"}, {"os": "Fedora ELN", "pkg": "barman", "status": "fixed", "fixed": "3.20.1-3.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-45ecf042c2", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ecf042c2", "note": "FEDORA-2026-45ecf042c2"}], "vendors_checked": "2026-10-23T23:09:01.822238+00:00", "vendor_fixed": true, "pocs": [{"kind": "poc", "name": "HORKimhab/CVE-2026-18577 (0 stars)", "url": "https://github.com/HORKimhab/CVE-2026-18577", "stars": 0}, {"kind": "nuclei", "name": "N-able N-central < 2026.3.1.10 - Authentication Bypass", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-18577.yaml"}], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-18556", "publisher": "N-able", "title": "N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability", "summary": "Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass.\n\nThis issue affects N-central: through 2026.1.", "cvss": 7.4, "sev": "HIGH", "epss": 0.07882, "kev": true, "added": "2026-08-01", "pub": "2026-08-01T20:16:37.157", "modified": "2026-10-23T22:10:00.160", "products": [{"name": "n-central", "vendor": "n-able", "type": "app", "affected": ["<= 2026.1"], "fixed": "newer than 2026.1", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy n-central || rpm -q n-central || n-central --version"}, {"label": "2. UPGRADE to newer than 2026.1 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade n-central"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade n-central"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-18556"}, {"t": "Vendor Advisory", "u": "https://uptime.n-able.com/"}, {"t": "Vendor Advisory", "u": "https://www.n-able.com/blog/n-central-security-update-august-2-2026"}], "cwe": ["CWE-288"], "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": "2026-08-07", "kev_added": "2026-08-04", "ransom": false, "priority": 83, "tier": "P0", "why": ["High severity", "EPSS top 5%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.94705, "vendors": [{"os": "Fedora 46", "pkg": "pspp", "status": "fixed", "fixed": "2.1.3-2.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0d6444911b", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d6444911b", "note": "FEDORA-2026-0d6444911b"}, {"os": "Fedora ELN", "pkg": "barman", "status": "fixed", "fixed": "3.20.1-3.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-45ecf042c2", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ecf042c2", "note": "FEDORA-2026-45ecf042c2"}], "vendors_checked": "2026-10-23T23:09:01.822238+00:00", "vendor_fixed": true, "pocs": [{"kind": "poc", "name": "CreamyG31337/ncentral-compromise-ioc-triage (0 stars)", "url": "https://github.com/CreamyG31337/ncentral-compromise-ioc-triage", "stars": 0}], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-51785", "publisher": "MITRE", "title": "An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a c", "summary": "An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.01149, "kev": false, "added": "2026-07-31", "pub": "2026-07-31T21:17:31.730", "modified": "2026-10-23T23:10:00.157", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-51785"}], "cwe": ["CWE-94"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 62, "tier": "P1", "why": ["Critical severity", "CISA SSVC: public proof of concept", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.66629, "pinned": false, "pocs": [{"kind": "writeup", "name": "fenrisk.com/hiawatha-http-smuggling", "url": "https://fenrisk.com/hiawatha-http-smuggling"}], "ssvc": {"exploitation": "poc", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "python-openslide", "status": "fixed", "fixed": "1.4.7-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-336bea884e", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-336bea884e", "note": "FEDORA-2026-336bea884e"}, {"os": "Fedora ELN", "pkg": "valgrind", "status": "fixed", "fixed": "3.28.0-1.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-c593ef1d15", "note": "FEDORA-2026-c593ef1d15"}], "vendors_checked": "2026-10-24T04:31:13.918852+00:00", "vendor_fixed": true}, {"id": "CVE-2026-38713", "publisher": "MITRE", "title": "TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19,", "summary": "TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the ipsec_conn interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.02753, "kev": false, "added": "2026-07-31", "pub": "2026-07-31T21:17:30.937", "modified": "2026-10-23T23:10:00.157", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-38713"}], "cwe": ["CWE-77"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 64, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.86126, "pinned": false, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "python-openslide", "status": "fixed", "fixed": "1.4.7-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-336bea884e", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-336bea884e", "note": "FEDORA-2026-336bea884e"}, {"os": "Fedora ELN", "pkg": "valgrind", "status": "fixed", "fixed": "3.28.0-1.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-c593ef1d15", "note": "FEDORA-2026-c593ef1d15"}], "vendors_checked": "2026-10-24T04:31:13.918852+00:00", "vendor_fixed": true}, {"id": "CVE-2026-38708", "publisher": "MITRE", "title": "TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19,", "summary": "TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the system.setclock interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.02753, "kev": false, "added": "2026-07-31", "pub": "2026-07-31T21:17:30.713", "modified": "2026-10-23T23:10:00.157", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-38708"}], "cwe": ["CWE-77"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 64, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.86127, "pinned": false, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "python-openslide", "status": "fixed", "fixed": "1.4.7-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-336bea884e", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-336bea884e", "note": "FEDORA-2026-336bea884e"}, {"os": "Fedora ELN", "pkg": "valgrind", "status": "fixed", "fixed": "3.28.0-1.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-c593ef1d15", "note": "FEDORA-2026-c593ef1d15"}], "vendors_checked": "2026-10-24T04:31:13.918852+00:00", "vendor_fixed": true}, {"id": "CVE-2026-38711", "publisher": "MITRE", "title": "TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19,", "summary": "TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the system.upgrade_check interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.02753, "kev": false, "added": "2026-07-31", "pub": "2026-07-31T20:16:50.190", "modified": "2026-10-23T23:10:00.157", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-38711"}], "cwe": ["CWE-77"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 64, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.86127, "pinned": false, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "python-openslide", "status": "fixed", "fixed": "1.4.7-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-336bea884e", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-336bea884e", "note": "FEDORA-2026-336bea884e"}, {"os": "Fedora ELN", "pkg": "valgrind", "status": "fixed", "fixed": "3.28.0-1.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-c593ef1d15", "note": "FEDORA-2026-c593ef1d15"}], "vendors_checked": "2026-10-24T04:31:13.918852+00:00", "vendor_fixed": true}, {"id": "CVE-2026-38709", "publisher": "MITRE", "title": "TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19,", "summary": "TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the net.set_wan interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.02753, "kev": false, "added": "2026-07-30", "pub": "2026-07-30T22:16:54.970", "modified": "2026-10-23T22:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-38709"}], "cwe": ["CWE-77"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 64, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.86127, "vendors": [{"os": "Fedora 46", "pkg": "pspp", "status": "fixed", "fixed": "2.1.3-2.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0d6444911b", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d6444911b", "note": "FEDORA-2026-0d6444911b"}, {"os": "Fedora ELN", "pkg": "barman", "status": "fixed", "fixed": "3.20.1-3.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-45ecf042c2", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ecf042c2", "note": "FEDORA-2026-45ecf042c2"}], "vendors_checked": "2026-10-23T23:09:01.822238+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-66803", "publisher": "Microsoft Corporation", "title": "Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.", "summary": "Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.", "cvss": 10.0, "sev": "CRITICAL", "epss": 0.00901, "kev": false, "added": "2026-07-30", "pub": "2026-07-30T21:18:12.743", "modified": "2026-10-23T22:10:00.160", "products": [{"name": "azure cosmos db", "vendor": "microsoft", "type": "app", "affected": ["all versions"], "fixed": null, "safe": null, "action": "mitigate", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy azure-cosmos-db || rpm -q azure-cosmos-db || azure-cosmos-db --version"}, {"label": "No fixed or unaffected release known", "cmd": "Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-66803"}, {"t": "Vendor Advisory", "u": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66803"}], "cwe": ["CWE-284"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 63, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.5934, "vendors": [{"os": "Fedora 46", "pkg": "pspp", "status": "fixed", "fixed": "2.1.3-2.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0d6444911b", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d6444911b", "note": "FEDORA-2026-0d6444911b"}, {"os": "Fedora ELN", "pkg": "barman", "status": "fixed", "fixed": "3.20.1-3.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-45ecf042c2", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ecf042c2", "note": "FEDORA-2026-45ecf042c2"}], "vendors_checked": "2026-10-23T23:09:01.822238+00:00", "vendor_fixed": true, "pocs": [], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-67208", "publisher": "VulnCheck", "title": "Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attacke", "summary": "Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint, authenticate with default credentials, and leverage the H2 CREATE ALIAS Runtime.exec() technique to execute arbitrary commands, resulting in root-level code ", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.04265, "kev": false, "added": "2026-07-30", "pub": "2026-07-30T20:18:14.323", "modified": "2026-10-23T22:10:00.160", "products": [], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-67208"}], "cwe": ["CWE-306", "CWE-1188"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 68, "tier": "P1", "why": ["Critical severity", "EPSS top 9%: very likely to be exploited", "CISA SSVC: public proof of concept", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.91044, "vendors": [{"os": "Fedora 46", "pkg": "pspp", "status": "fixed", "fixed": "2.1.3-2.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0d6444911b", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d6444911b", "note": "FEDORA-2026-0d6444911b"}, {"os": "Fedora ELN", "pkg": "barman", "status": "fixed", "fixed": "3.20.1-3.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-45ecf042c2", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ecf042c2", "note": "FEDORA-2026-45ecf042c2"}], "vendors_checked": "2026-10-23T23:09:01.822238+00:00", "vendor_fixed": true, "pocs": [{"kind": "writeup", "name": "github.com/somta/Juggle/issues/86", "url": "https://github.com/somta/Juggle/issues/86"}, {"kind": "nuclei", "name": "Juggle <= 1.6.0 - Unauthenticated Exposed H2 Database Console", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-67208.yaml"}], "ssvc": {"exploitation": "poc", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-52680", "publisher": "Apache Software Foundation", "title": "Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a", "summary": "Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource. A remote attacker who can access the REST batch upload endpoint can provide path traversal sequences in the filename and cause the Kyuubi server process to write controlled content outside the intended upload directory, subject to filesystem permissions.\n\n\nThis issue affects Apache Kyuubi: from 1.7.0 through ", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.0111, "kev": false, "added": "2026-07-30", "pub": "2026-07-30T16:17:14.040", "modified": "2026-10-23T22:10:00.160", "products": [{"name": "kyuubi", "vendor": "apache", "type": "app", "affected": [">= 1.7.0 and < 1.12.0"], "fixed": "1.12.0", "safe": "before 1.7.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy kyuubi || rpm -q kyuubi || kyuubi --version"}, {"label": "2. UPGRADE to 1.12.0 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade kyuubi"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade kyuubi"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 1.7.0 (Debian / Ubuntu)", "cmd": "apt-cache madison kyuubi\nsudo apt install kyuubi=<VERSION_BEFORE_1.7.0>\nsudo apt-mark hold kyuubi"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list kyuubi\nsudo dnf downgrade kyuubi-<VERSION_BEFORE_1.7.0>\nsudo dnf versionlock add kyuubi"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-52680"}, {"t": "Mailing List, Vendor Advisory", "u": "https://lists.apache.org/thread/b0qx2v8k5v4rrqsh53pb146t7so0lmrk"}], "cwe": ["CWE-22", "CWE-73"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 64, "tier": "P1", "why": ["Critical severity", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.65661, "vendors": [{"os": "Fedora 46", "pkg": "pspp", "status": "fixed", "fixed": "2.1.3-2.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0d6444911b", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d6444911b", "note": "FEDORA-2026-0d6444911b"}, {"os": "Fedora ELN", "pkg": "barman", "status": "fixed", "fixed": "3.20.1-3.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-45ecf042c2", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ecf042c2", "note": "FEDORA-2026-45ecf042c2"}], "vendors_checked": "2026-10-23T23:09:01.822238+00:00", "vendor_fixed": true, "pocs": [{"kind": "poc", "name": "0xdak/CVE-2026-52680_exploit (0 stars)", "url": "https://github.com/0xdak/CVE-2026-52680_exploit", "stars": 0}], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2026-60113", "publisher": "VulnCheck", "title": "AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing authenticati", "summary": "AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension (SLE) interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no credentials. Attackers can reach the exposed SLE endpoints to start or stop Deep Space Network communication sessions, retrieve telemetry frame da", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.00833, "kev": false, "added": "2026-07-29", "pub": "2026-07-29T16:17:55.560", "modified": "2026-10-23T23:10:00.157", "products": [{"name": "ait dsn", "vendor": "nasa", "type": "app", "affected": ["< 2.2.2"], "fixed": "2.2.2", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy ait-dsn || rpm -q ait-dsn || ait-dsn --version"}, {"label": "2. UPGRADE to 2.2.2 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade ait-dsn"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade ait-dsn"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-60113"}, {"t": "Patch", "u": "https://github.com/NASA-AMMOS/AIT-DSN/commit/06d07d1a525602c62c6eaeaeff2544196f430340"}, {"t": "Exploit, Vendor Advisory", "u": "https://github.com/NASA-AMMOS/AIT-DSN/security/advisories/GHSA-gj83-67wr-82mv"}, {"t": "Patch, Release Notes", "u": "https://www.vulncheck.com/advisories/ait-dsn-missing-authentication-via-sle-api-routes"}, {"t": "Exploit, Vendor Advisory", "u": "https://github.com/NASA-AMMOS/AIT-DSN/security/advisories/GHSA-gj83-67wr-82mv"}], "cwe": ["CWE-306"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": null, "kev_added": null, "ransom": false, "priority": 62, "tier": "P1", "why": ["Critical severity", "Public exploit reference", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.57235, "pinned": false, "pocs": [], "ssvc": {"exploitation": "poc", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "python-openslide", "status": "fixed", "fixed": "1.4.7-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-336bea884e", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-336bea884e", "note": "FEDORA-2026-336bea884e"}, {"os": "Fedora ELN", "pkg": "valgrind", "status": "fixed", "fixed": "3.28.0-1.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-c593ef1d15", "note": "FEDORA-2026-c593ef1d15"}], "vendors_checked": "2026-10-24T04:31:13.918852+00:00", "vendor_fixed": true}, {"id": "CVE-2026-42016", "publisher": "JFrog", "title": "JFrog Artifactory Incorrect Authorization Vulnerability", "summary": "JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token\u2019s scope.", "cvss": 8.1, "sev": "HIGH", "epss": 0.08643, "kev": true, "added": "2026-07-27", "pub": "2026-07-27T20:16:39.613", "modified": "2026-09-12T04:16:32.483", "products": [{"name": "artifactory", "vendor": "jfrog", "type": "app", "affected": ["< 7.133.11"], "fixed": "7.133.11", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy artifactory || rpm -q artifactory || artifactory --version"}, {"label": "2. UPGRADE to 7.133.11 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade artifactory"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade artifactory"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-42016"}, {"t": "Vendor Advisory", "u": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories"}], "cwe": ["CWE-863"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": "2026-09-25", "kev_added": "2026-09-11", "ransom": false, "priority": 77, "tier": "P0", "why": ["High severity", "EPSS top 5%: very likely to be exploited", "Exploited in the wild (CISA KEV)"], "fix": true, "watched": false, "epss_pct": 0.9511, "pinned": false, "pocs": [{"kind": "writeup", "name": "www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-20", "url": "https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201"}], "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true, "mentions": [{"src": "Wiz Research", "group": "research", "title": "Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329", "url": "https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201", "date": "2026-09-10"}], "buzz": 1}, {"id": "CVE-2026-9586", "publisher": "Security Risk Advisors", "title": "Sangoma Switchvox SQL Injection Vulnerability", "summary": "An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997).\u00a0The /pa endpoint processes XML\u00a0content beginning with <PolycomIPPhone> and\u00a0directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization.\u00a0An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, includin", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.18979, "kev": true, "added": "2026-07-17", "pub": "2026-07-17T17:17:18.150", "modified": "2026-09-03T13:06:25.427", "products": [{"name": "switchvox", "vendor": "sangoma", "type": "app", "affected": [">= 8.2.2.1 and < 8.4.0.2"], "fixed": "8.4.0.2", "safe": "before 8.2.2.1", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy switchvox || rpm -q switchvox || switchvox --version"}, {"label": "2. UPGRADE to 8.4.0.2 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade switchvox"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade switchvox"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 8.2.2.1 (Debian / Ubuntu)", "cmd": "apt-cache madison switchvox\nsudo apt install switchvox=<VERSION_BEFORE_8.2.2.1>\nsudo apt-mark hold switchvox"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list switchvox\nsudo dnf downgrade switchvox-<VERSION_BEFORE_8.2.2.1>\nsudo dnf versionlock add switchvox"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-9586"}], "cwe": ["CWE-89"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-09-05", "kev_added": "2026-09-02", "ransom": false, "priority": 97, "tier": "P0", "why": ["Critical severity", "EPSS top 3%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.973, "pocs": [{"kind": "poc", "name": "fromABUV/CVE-2026-9586_POC_EXPLOIT (1 stars)", "url": "https://github.com/fromABUV/CVE-2026-9586_POC_EXPLOIT", "stars": 1}, {"kind": "poc", "name": "HORKimhab/CVE-2026-9586 (0 stars)", "url": "https://github.com/HORKimhab/CVE-2026-9586", "stars": 0}, {"kind": "writeup", "name": "sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+V", "url": "https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026"}, {"kind": "nuclei", "name": "Sangoma Switchvox < 8.4.0.2 - Unauthenticated SQL Injection", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-9586.yaml"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true}, {"id": "CVE-2026-59822", "publisher": "GitHub, Inc.", "title": "BerriAI LiteLLM Improper Authentication Vulnerability", "summary": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.", "cvss": 8.2, "sev": "HIGH", "epss": 0.00836, "kev": true, "added": "2026-07-08", "pub": "2026-07-08T20:16:57.683", "modified": "2026-09-03T13:05:59.573", "products": [{"name": "litellm", "vendor": "litellm", "type": "app", "affected": ["< 1.84.0"], "fixed": "1.84.0", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy litellm || rpm -q litellm || litellm --version"}, {"label": "2. UPGRADE to 1.84.0 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade litellm"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade litellm"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-59822"}, {"t": "Patch", "u": "https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c"}, {"t": "Issue Tracking, Patch", "u": "https://github.com/BerriAI/litellm/pull/26463"}, {"t": "Mitigation, Patch", "u": "https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q"}], "cwe": ["CWE-287", "CWE-306"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": "2026-09-16", "kev_added": "2026-09-02", "ransom": false, "priority": 73, "tier": "P0", "why": ["High severity", "Exploited in the wild (CISA KEV)", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.57323, "pinned": false, "pocs": [{"kind": "poc", "name": "HORKimhab/CVE-2026-59822 (0 stars)", "url": "https://github.com/HORKimhab/CVE-2026-59822", "stars": 0}, {"kind": "writeup", "name": "www.wiz.io/blog/ai-infrastructure-honeypot", "url": "https://www.wiz.io/blog/ai-infrastructure-honeypot"}], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "partial"}, "vendors": [{"os": "Python (pip)", "pkg": "litellm", "status": "fixed", "fixed": "1.84.0", "cmd": "pip install --upgrade \"litellm>=1.84.0\"\npip show litellm", "url": "https://github.com/advisories/GHSA-7488-6r32-c95q", "note": "vulnerable: < 1.84.0"}, {"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true}, {"id": "CVE-2026-53362", "publisher": "kernel.org", "title": "Linux Kernel Unspecified Vulnerability", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: account for fraggap on the paged allocation path\n\nIn __ip6_append_data(), when the paged-allocation branch is taken\n(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are\ncomputed as\n\n\talloclen = fragheaderlen + transhdrlen;\n\tpagedlen = datalen - transhdrlen;\n\ndatalen already includes fraggap (datalen = length + fraggap). When\nfraggap is non-zero, this is not t", "cvss": 7.8, "sev": "HIGH", "epss": 0.00709, "kev": true, "added": "2026-07-04", "pub": "2026-07-04T12:17:02.113", "modified": "2026-10-15T13:46:55.187", "products": [{"name": "linux kernel", "vendor": "linux", "type": "os", "affected": [">= 6.0 and < 6.1.177", ">= 6.2 and < 6.6.144", ">= 6.7 and < 6.12.95", ">= 6.13 and < 6.18.38", ">= 6.19 and < 7.1.3"], "fixed": "6.1.177, 6.6.144, 6.12.95, 6.18.38, 7.1.3", "safe": null, "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "simatic s7-1500 tm mfp firmware", "vendor": "siemens", "type": "os", "affected": ["all versions"], "fixed": null, "safe": null, "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-53362"}, {"t": "Patch", "u": "https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962"}, {"t": "Patch", "u": "https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d"}, {"t": "Patch", "u": "https://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a"}, {"t": "Patch", "u": "https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769"}, {"t": "Patch", "u": "https://git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5"}, {"t": "Patch", "u": "https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74e"}], "cwe": ["CWE-787", "CWE-122"], "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "L", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": "2026-08-30", "kev_added": "2026-08-27", "ransom": false, "priority": 71, "tier": "P0", "why": ["High severity", "Exploited in the wild (CISA KEV)", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.52994, "pinned": false, "pocs": [{"kind": "poc", "name": "suominen/ipv6_frag_escape (0 stars)", "url": "https://github.com/suominen/ipv6_frag_escape", "stars": 0}, {"kind": "writeup", "name": "cert-portal.siemens.com/productcert/html/ssa-784472.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "python-streamlink", "status": "fixed", "fixed": "8.6.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-a56fcfdc08", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-a56fcfdc08", "note": "FEDORA-2026-a56fcfdc08"}, {"os": "Fedora ELN", "pkg": "valgrind", "status": "fixed", "fixed": "3.28.0-1.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-c593ef1d15", "note": "FEDORA-2026-c593ef1d15"}, {"os": "Ubuntu 20.04", "pkg": "linux", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Ubuntu 22.04", "pkg": "linux", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Ubuntu 24.04", "pkg": "linux", "status": "fixed", "fixed": "6.8.0-147.147", "cmd": "sudo apt update && sudo apt install --only-upgrade linux\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' linux)\" ge \"6.8.0-147.147\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Ubuntu 20.04", "pkg": "linux-hwe-5.15", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Ubuntu 22.04", "pkg": "linux-hwe-6.8", "status": "vulnerable", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Debian 12", "pkg": "linux", "status": "fixed", "fixed": "6.1.177-1", "cmd": "sudo apt update && sudo apt install --only-upgrade linux\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' linux)\" ge \"6.1.177-1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Debian 13", "pkg": "linux", "status": "fixed", "fixed": "6.12.95-1", "cmd": "sudo apt update && sudo apt install --only-upgrade linux\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' linux)\" ge \"6.12.95-1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "RHEL 10", "pkg": "kernel", "status": "fixed", "fixed": "kernel-6.12.0-211.30.1.el10_2", "cmd": "sudo dnf upgrade --advisory=RHSA-2026:34911\nrpm -q kernel", "url": null, "note": null}, {"os": "RHEL 10.0 Extended Update Support", "pkg": "kernel", "status": "fixed", "fixed": "kernel-6.12.0-55.86.1.el10_0", "cmd": "sudo dnf upgrade --advisory=RHSA-2026:35840\nrpm -q kernel", "url": null, "note": null}, {"os": "RHEL 6", "pkg": "kernel", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "RHEL 7", "pkg": "kernel", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "RHEL 7", "pkg": "kernel-rt", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Amazon Linux 2023", "pkg": "see advisory", "status": "fixed", "fixed": null, "cmd": "sudo dnf update --advisory=ALAS2023-2026-1938", "url": "https://alas.aws.amazon.com/cve/html/CVE-2026-53362.html", "note": "ALAS2023-2026-1938"}], "vendors_checked": "2026-10-24T06:05:19.655601+00:00", "vendor_fixed": true}, {"id": "CVE-2026-8452", "publisher": "NetScaler", "title": "Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability", "summary": "Memory overflow vulnerability\u00a0NetScaler ADC and NetScaler Gateway\u00a0leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a\u00a0Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.01011, "kev": true, "added": "2026-06-30", "pub": "2026-06-30T13:19:33.450", "modified": "2026-08-27T04:18:00.787", "products": [{"name": "netscaler application delivery controller", "vendor": "citrix", "type": "app", "affected": ["< 13.1-37.272", ">= 13.1 and < 13.1-63.18", ">= 14.1 and < 14.1-72.61", "14.1-66.68"], "fixed": "13.1-37.272, 13.1-63.18, 14.1-72.61", "safe": "before 13.1", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy netscaler-application-delivery-controller || rpm -q netscaler-application-delivery-controller || netscaler-application-delivery-controller --version"}, {"label": "2. UPGRADE to 13.1-37.272 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade netscaler-application-delivery-controller"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade netscaler-application-delivery-controller"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 13.1 (Debian / Ubuntu)", "cmd": "apt-cache madison netscaler-application-delivery-controller\nsudo apt install netscaler-application-delivery-controller=<VERSION_BEFORE_13.1>\nsudo apt-mark hold netscaler-application-delivery-controller"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list netscaler-application-delivery-controller\nsudo dnf downgrade netscaler-application-delivery-controller-<VERSION_BEFORE_13.1>\nsudo dnf versionlock add netscaler-application-delivery-controller"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "netscaler gateway", "vendor": "citrix", "type": "app", "affected": [">= 13.1 and < 13.1-63.18", ">= 14.1 and < 14.1-72.61"], "fixed": "13.1-63.18, 14.1-72.61", "safe": "before 13.1", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy netscaler-gateway || rpm -q netscaler-gateway || netscaler-gateway --version"}, {"label": "2. UPGRADE to 13.1-63.18 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade netscaler-gateway"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade netscaler-gateway"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 13.1 (Debian / Ubuntu)", "cmd": "apt-cache madison netscaler-gateway\nsudo apt install netscaler-gateway=<VERSION_BEFORE_13.1>\nsudo apt-mark hold netscaler-gateway"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list netscaler-gateway\nsudo dnf downgrade netscaler-gateway-<VERSION_BEFORE_13.1>\nsudo dnf versionlock add netscaler-gateway"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-8452"}, {"t": "Vendor Advisory", "u": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604"}], "cwe": ["CWE-119"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-08-29", "kev_added": "2026-08-26", "ransom": false, "priority": 85, "tier": "P0", "why": ["Critical severity", "Exploited in the wild (CISA KEV)", "Public exploit reference", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.6287, "pinned": false, "pocs": [{"kind": "poc", "name": "securekomodo/citrixInspector (96 stars)", "url": "https://github.com/securekomodo/citrixInspector", "stars": 96}, {"kind": "poc", "name": "watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452 (65 stars)", "url": "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452", "stars": 65}, {"kind": "poc", "name": "BishopFox/CVE-2026-8452-check (1 stars)", "url": "https://github.com/BishopFox/CVE-2026-8452-check", "stars": 1}], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "partial"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true, "mentions": [{"src": "watchTowr Labs", "group": "research", "title": "You\u2019re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))", "url": "https://labs.watchtowr.com/youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452/", "date": "2026-08-14"}], "buzz": 1}, {"id": "CVE-2026-49869", "publisher": "GitHub, Inc.", "title": "Kestra OSS OS Command Injection Vulnerability", "summary": "Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith(\"/configs\") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and exec", "cvss": 10.0, "sev": "CRITICAL", "epss": 0.02095, "kev": true, "added": "2026-06-26", "pub": "2026-06-26T22:16:32.113", "modified": "2026-09-03T13:05:55.387", "products": [{"name": "kestra", "vendor": "kestra", "type": "app", "affected": ["< 1.0.45", ">= 1.1.0 and < 1.3.21"], "fixed": "1.0.45, 1.3.21", "safe": "before 1.1.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy kestra || rpm -q kestra || kestra --version"}, {"label": "2. UPGRADE to 1.0.45 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade kestra"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade kestra"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 1.1.0 (Debian / Ubuntu)", "cmd": "apt-cache madison kestra\nsudo apt install kestra=<VERSION_BEFORE_1.1.0>\nsudo apt-mark hold kestra"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list kestra\nsudo dnf downgrade kestra-<VERSION_BEFORE_1.1.0>\nsudo dnf versionlock add kestra"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-49869"}, {"t": "Exploit, Vendor Advisory", "u": "https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx"}, {"t": "Exploit, Vendor Advisory", "u": "https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx"}], "cwe": ["CWE-78", "CWE-184", "CWE-287", "CWE-918"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-09-05", "kev_added": "2026-09-02", "ransom": false, "priority": 93, "tier": "P0", "why": ["Critical severity", "Exploited in the wild (CISA KEV)", "Public exploit reference", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.81526, "pinned": false, "pocs": [{"kind": "poc", "name": "EQSTLab/CVE-2026-49869 (4 stars)", "url": "https://github.com/EQSTLab/CVE-2026-49869", "stars": 4}, {"kind": "poc", "name": "Ap0dexMe0/CVE-2026-49869 (3 stars)", "url": "https://github.com/Ap0dexMe0/CVE-2026-49869", "stars": 3}, {"kind": "writeup", "name": "github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx", "url": "https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx"}], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true}, {"id": "CVE-2026-53266", "publisher": "kernel.org", "title": "Linux Kernel Out-of-Bounds Write Vulnerability", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: make ebt_snat ARP rewrite writable\n\nThe ebtables SNAT target keeps the Ethernet source address rewrite\nbehind skb_ensure_writable(skb, 0).  This is intentional: at the bridge\nebtables hooks the Ethernet header is addressed through\nskb_mac_header()/eth_hdr(), while skb->data points at the Ethernet\npayload.  Asking skb_ensure_writable() for ETH_HLEN bytes would ", "cvss": 8.8, "sev": "HIGH", "epss": 0.00827, "kev": true, "added": "2026-06-25", "pub": "2026-06-25T09:16:44.643", "modified": "2026-09-19T04:17:53.580", "products": [{"name": "linux kernel", "vendor": "linux", "type": "os", "affected": [">= 5.4.73 and < 5.5", ">= 5.8.17 and < 5.9", ">= 5.9.2 and < 5.10.259", ">= 5.11 and < 5.15.210", ">= 5.16 and < 6.1.176", ">= 6.2 and < 6.6.143", ">= 6.7 and < 6.12.94", ">= 6.13 and < 6.18.36"], "fixed": "5.5, 5.9, 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13", "safe": null, "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-53266"}, {"t": "Patch", "u": "https://git.kernel.org/stable/c/153ea96c806aea395daba907a4f88480b6ad5093"}, {"t": "Patch", "u": "https://git.kernel.org/stable/c/67ba971ae02514d85818fe0c32549ab4bfa3bf49"}, {"t": "Patch", "u": "https://git.kernel.org/stable/c/76280b78cc9f23bdc6438e10ad6dff148ef8375b"}, {"t": "Patch", "u": "https://git.kernel.org/stable/c/afd64b59c3de9bbbdd3759e834fdc55cda716e0b"}, {"t": "Patch", "u": "https://git.kernel.org/stable/c/b18675263db1147c8e1cab625400c13a0d87bd2d"}, {"t": "Patch", "u": "https://git.kernel.org/stable/c/b7e91939ba9be805a62a257fa4e227dffbb88fa0"}], "cwe": ["CWE-787"], "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "attack": {"av": "L", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": "2026-09-21", "kev_added": "2026-09-18", "ransom": false, "priority": 75, "tier": "P0", "why": ["High severity", "Exploited in the wild (CISA KEV)", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.57056, "pinned": false, "pocs": [{"kind": "poc", "name": "suominen/CVE-2026-53266 (0 stars)", "url": "https://github.com/suominen/CVE-2026-53266", "stars": 0}], "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "python-streamlink", "status": "fixed", "fixed": "8.6.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-a56fcfdc08", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-a56fcfdc08", "note": "FEDORA-2026-a56fcfdc08"}, {"os": "Fedora ELN", "pkg": "valgrind", "status": "fixed", "fixed": "3.28.0-1.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-c593ef1d15", "note": "FEDORA-2026-c593ef1d15"}, {"os": "Ubuntu 20.04", "pkg": "linux", "status": "vulnerable", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Ubuntu 22.04", "pkg": "linux", "status": "fixed", "fixed": "5.15.0-198.208", "cmd": "sudo apt update && sudo apt install --only-upgrade linux\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' linux)\" ge \"5.15.0-198.208\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Ubuntu 24.04", "pkg": "linux", "status": "fixed", "fixed": "6.8.0-146.146", "cmd": "sudo apt update && sudo apt install --only-upgrade linux\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' linux)\" ge \"6.8.0-146.146\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Ubuntu 20.04", "pkg": "linux-hwe-5.15", "status": "fixed", "fixed": "5.15.0-198.208~20.04.1", "cmd": "sudo apt update && sudo apt install --only-upgrade linux-hwe-5.15\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' linux-hwe-5.15)\" ge \"5.15.0-198.208~20.04.1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Ubuntu 22.04", "pkg": "linux-hwe-6.8", "status": "vulnerable", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Debian 12", "pkg": "linux", "status": "fixed", "fixed": "6.1.176-1", "cmd": "sudo apt update && sudo apt install --only-upgrade linux\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' linux)\" ge \"6.1.176-1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Debian 13", "pkg": "linux", "status": "fixed", "fixed": "6.12.94-1", "cmd": "sudo apt update && sudo apt install --only-upgrade linux\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' linux)\" ge \"6.12.94-1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "RHEL 10", "pkg": "kernel", "status": "fixed", "fixed": "kernel-6.12.0-211.59.1.el10_2", "cmd": "sudo dnf upgrade --advisory=RHSA-2026:71233\nrpm -q kernel", "url": null, "note": null}, {"os": "RHEL 10.0 Extended Update Support", "pkg": "kernel", "status": "fixed", "fixed": "kernel-6.12.0-55.106.1.el10_0", "cmd": "sudo dnf upgrade --advisory=RHSA-2026:71326\nrpm -q kernel", "url": null, "note": null}, {"os": "RHEL 6 Extended Lifecycle Support  - EXTENSION", "pkg": "kernel", "status": "fixed", "fixed": "kernel-2.6.32-754.64.1.el6", "cmd": "sudo dnf upgrade --advisory=RHSA-2026:73732\nrpm -q kernel", "url": null, "note": null}, {"os": "RHEL 7 Extended Lifecycle Support", "pkg": "kernel-rt", "status": "fixed", "fixed": "kernel-rt-3.10.0-1160.164.1.rt56.1316.el7", "cmd": "sudo dnf upgrade --advisory=RHSA-2026:71657\nrpm -q kernel-rt", "url": null, "note": null}, {"os": "RHEL 7 Extended Lifecycle Support", "pkg": "kernel", "status": "fixed", "fixed": "kernel-3.10.0-1160.164.1.el7", "cmd": "sudo dnf upgrade --advisory=RHSA-2026:71687\nrpm -q kernel", "url": null, "note": null}, {"os": "Amazon Linux 2023", "pkg": "see advisory", "status": "fixed", "fixed": null, "cmd": "sudo dnf update --advisory=ALAS2023-2026-1968", "url": "https://alas.aws.amazon.com/cve/html/CVE-2026-53266.html", "note": "ALAS2023-2026-1968"}], "vendors_checked": "2026-10-24T06:05:19.655601+00:00", "vendor_fixed": true}, {"id": "CVE-2026-7273", "publisher": "Zyxel Corporation", "title": "Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability", "summary": "A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through\u00a02.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.", "cvss": 8.8, "sev": "HIGH", "epss": 0.02501, "kev": true, "added": "2026-06-16", "pub": "2026-06-16T03:16:13.557", "modified": "2026-09-22T12:10:51.067", "products": [{"name": "gs1900-8 firmware", "vendor": "zyxel", "type": "os", "affected": ["< 2.90\\(aahh.2\\)c0"], "fixed": "2.90\\(aahh.2\\)c0", "safe": null, "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "gs1900-8hp firmware", "vendor": "zyxel", "type": "os", "affected": ["< 2.90\\(aahi.2\\)c0"], "fixed": "2.90\\(aahi.2\\)c0", "safe": null, "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "gs1900-10hp firmware", "vendor": "zyxel", "type": "os", "affected": ["< 2.90\\(aazi.2\\)c0"], "fixed": "2.90\\(aazi.2\\)c0", "safe": null, "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "gs1900-16 firmware", "vendor": "zyxel", "type": "os", "affected": ["< 2.90\\(aahj.2\\)c0"], "fixed": "2.90\\(aahj.2\\)c0", "safe": null, "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "gs1900-24 firmware", "vendor": "zyxel", "type": "os", "affected": ["< 2.90\\(aahl.2\\)c0"], "fixed": "2.90\\(aahl.2\\)c0", "safe": null, "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "gs1900-24e firmware", "vendor": "zyxel", "type": "os", "affected": ["< 2.90\\(aahk.2\\)c0"], "fixed": "2.90\\(aahk.2\\)c0", "safe": null, "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-7273"}, {"t": "Vendor Advisory", "u": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026"}], "cwe": ["CWE-121"], "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "A", "ac": "L", "pr": "N", "ui": "N"}, "remote": false, "exploit": true, "kev_due": "2026-09-24", "kev_added": "2026-09-21", "ransom": false, "priority": 82, "tier": "P0", "why": ["High severity", "Exploited in the wild (CISA KEV)", "Public exploit reference"], "fix": true, "watched": false, "epss_pct": 0.84595, "pinned": false, "pocs": [], "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true}, {"id": "CVE-2026-48710", "publisher": "GitHub, Inc.", "title": "Kludex Starlette HTTP Request/Response Smuggling Vulnerability", "summary": "Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on", "cvss": 6.5, "sev": "MEDIUM", "epss": 0.07056, "kev": true, "added": "2026-05-26", "pub": "2026-05-26T22:16:44.020", "modified": "2026-10-01T18:17:18.153", "products": [{"name": "starlette", "vendor": "encode", "type": "app", "affected": [">= 0.8.3 and < 1.0.1"], "fixed": "1.0.1", "safe": "before 0.8.3", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "pip show starlette"}, {"label": "2. UPGRADE to 1.0.1", "cmd": "pip install --upgrade \"starlette>=1.0.1\""}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 0.8.3", "cmd": "pip index versions starlette\npip install \"starlette<0.8.3\""}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "ai inference server", "vendor": "redhat", "type": "app", "affected": [">= 3.3.0 and <= 3.3.5"], "fixed": "newer than 3.3.5", "safe": "before 3.3.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy ai-inference-server || rpm -q ai-inference-server || ai-inference-server --version"}, {"label": "2. UPGRADE to newer than 3.3.5 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade ai-inference-server"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade ai-inference-server"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 3.3.0 (Debian / Ubuntu)", "cmd": "apt-cache madison ai-inference-server\nsudo apt install ai-inference-server=<VERSION_BEFORE_3.3.0>\nsudo apt-mark hold ai-inference-server"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list ai-inference-server\nsudo dnf downgrade ai-inference-server-<VERSION_BEFORE_3.3.0>\nsudo dnf versionlock add ai-inference-server"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "ansible automation platform", "vendor": "redhat", "type": "app", "affected": ["2.6", "2.7"], "fixed": null, "safe": "before 2.6", "action": "downgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy ansible-automation-platform || rpm -q ansible-automation-platform || ansible-automation-platform --version"}, {"label": "2. No fixed release: DOWNGRADE to a release before 2.6 (Debian / Ubuntu)", "cmd": "apt-cache madison ansible-automation-platform\nsudo apt install ansible-automation-platform=<VERSION_BEFORE_2.6>\nsudo apt-mark hold ansible-automation-platform"}, {"label": "2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list ansible-automation-platform\nsudo dnf downgrade ansible-automation-platform-<VERSION_BEFORE_2.6>\nsudo dnf versionlock add ansible-automation-platform"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "migration toolkit for applications", "vendor": "redhat", "type": "app", "affected": ["< 8.2.0"], "fixed": "8.2.0", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy migration-toolkit-for-applications || rpm -q migration-toolkit-for-applications || migration-toolkit-for-applications --version"}, {"label": "2. UPGRADE to 8.2.0 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade migration-toolkit-for-applications"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade migration-toolkit-for-applications"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}, {"name": "openshift ai", "vendor": "redhat", "type": "app", "affected": [">= 3.3 and < 3.3.5", ">= 3.4 and < 3.4.2"], "fixed": "3.3.5, 3.4.2", "safe": "before 3.3", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy openshift-ai || rpm -q openshift-ai || openshift-ai --version"}, {"label": "2. UPGRADE to 3.3.5 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade openshift-ai"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade openshift-ai"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 3.3 (Debian / Ubuntu)", "cmd": "apt-cache madison openshift-ai\nsudo apt install openshift-ai=<VERSION_BEFORE_3.3>\nsudo apt-mark hold openshift-ai"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list openshift-ai\nsudo dnf downgrade openshift-ai-<VERSION_BEFORE_3.3>\nsudo dnf versionlock add openshift-ai"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "openshift lightspeed", "vendor": "redhat", "type": "app", "affected": ["all versions"], "fixed": null, "safe": null, "action": "mitigate", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy openshift-lightspeed || rpm -q openshift-lightspeed || openshift-lightspeed --version"}, {"label": "No fixed or unaffected release known", "cmd": "Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-48710"}, {"t": "Mitigation, Third Party Advisory", "u": "https://badhost.org"}, {"t": "Patch", "u": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"}, {"t": "Vendor Advisory", "u": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"}, {"t": "Mitigation, Third Party Advisory", "u": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"}, {"t": "Exploit, Mitigation", "u": "https://www.secwest.net/starlette"}, {"t": "Exploit, Mitigation", "u": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"}], "cwe": ["CWE-444", "CWE-1289"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-09-16", "kev_added": "2026-09-02", "ransom": false, "priority": 86, "tier": "P0", "why": ["EPSS top 6%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "Remotely exploitable, no login, no user action", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.94194, "pocs": [{"kind": "poc", "name": "eris-ths/supply-chain-guard (3 stars)", "url": "https://github.com/eris-ths/supply-chain-guard", "stars": 3}, {"kind": "poc", "name": "xtremebeing/starlette-host-header-lab (1 stars)", "url": "https://github.com/xtremebeing/starlette-host-header-lab", "stars": 1}, {"kind": "poc", "name": "Bhanunamikaze/BadHost-CVE-2026-48710-Exploit (1 stars)", "url": "https://github.com/Bhanunamikaze/BadHost-CVE-2026-48710-Exploit", "stars": 1}, {"kind": "writeup", "name": "ostif.org/disclosing-the-badhost-vulnerability-in-starlette", "url": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"}, {"kind": "writeup", "name": "www.secwest.net/starlette", "url": "https://www.secwest.net/starlette"}, {"kind": "writeup", "name": "www.wiz.io/blog/ai-infrastructure-honeypot", "url": "https://www.wiz.io/blog/ai-infrastructure-honeypot"}, {"kind": "nuclei", "name": "Starlette - Improper Validation of Unsafe Equivalence in Input", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48710.yaml"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "partial"}, "vendors": [{"os": "Python (pip)", "pkg": "starlette", "status": "fixed", "fixed": "1.0.1", "cmd": "pip install --upgrade \"starlette>=1.0.1\"\npip show starlette", "url": "https://github.com/advisories/GHSA-86qp-5c8j-p5mr", "note": "vulnerable: <= 1.0.0"}, {"os": "Fedora 46", "pkg": "python-streamlink", "status": "fixed", "fixed": "8.6.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-a56fcfdc08", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-a56fcfdc08", "note": "FEDORA-2026-a56fcfdc08"}, {"os": "Fedora ELN", "pkg": "valgrind", "status": "fixed", "fixed": "3.28.0-1.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-c593ef1d15", "note": "FEDORA-2026-c593ef1d15"}, {"os": "Debian 12", "pkg": "starlette", "status": "fixed", "fixed": "0.26.1-1+deb12u1", "cmd": "sudo apt update && sudo apt install --only-upgrade starlette\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' starlette)\" ge \"0.26.1-1+deb12u1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Debian 13", "pkg": "starlette", "status": "fixed", "fixed": "0.46.1-3+deb13u2", "cmd": "sudo apt update && sudo apt install --only-upgrade starlette\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' starlette)\" ge \"0.46.1-3+deb13u2\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "RHEL AI (RHEL AI) 3", "pkg": "rhelai3/bootc-azure-rocm-rhel9", "status": "vulnerable", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "RHEL AI (RHEL AI) 3", "pkg": "rhelai3/bootc-gaudi-rhel9", "status": "deferred", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "RHEL AI (RHEL AI) 3", "pkg": "rhelai3/bootc-rocm-rhel9", "status": "vulnerable", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Alpine 3.24", "pkg": "py3-starlette", "status": "fixed", "fixed": "py3-starlette-1.1.0-r0", "cmd": "apk add --upgrade py3-starlette\napk info -v py3-starlette", "url": null, "note": null}], "vendors_checked": "2026-10-24T06:05:19.655601+00:00", "vendor_fixed": true}, {"id": "CVE-2026-34977", "publisher": "GitHub, Inc.", "title": "Aperi'Solve is an open-source steganalysis web platform", "summary": "Aperi'Solve is an open-source steganalysis web platform. In versions 3.1.3 through 3.2.0, when uploading a JPEG, a user can specify an optional password to accompany the JPEG. This password is then directly passed into an expect command, which is then subsequently passed into a bash -c command, without any form of sanitization or validation. An unauthenticated attacker can achieve root-level RCE inside the worker container with a single HTTP requ", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.01166, "kev": false, "added": "2026-04-06", "pub": "2026-04-06T17:17:11.543", "modified": "2026-10-23T23:10:00.157", "products": [{"name": "aperisolve", "vendor": "aperisolve", "type": "app", "affected": ["<= 3.2.0"], "fixed": "newer than 3.2.0", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy aperisolve || rpm -q aperisolve || aperisolve --version"}, {"label": "2. UPGRADE to newer than 3.2.0 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade aperisolve"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade aperisolve"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-34977"}, {"t": "Patch", "u": "https://github.com/Zeecka/AperiSolve/commit/0193ca4a7d8ae9d6ba6cde82d37a6f94953463b4"}, {"t": "Patch", "u": "https://github.com/Zeecka/AperiSolve/pull/195"}, {"t": "Exploit, Vendor Advisory", "u": "https://github.com/Zeecka/AperiSolve/security/advisories/GHSA-8r22-62p7-9jrp"}, {"t": "Exploit, Vendor Advisory", "u": "https://github.com/Zeecka/AperiSolve/security/advisories/GHSA-8r22-62p7-9jrp"}], "cwe": ["CWE-78"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": null, "kev_added": null, "ransom": false, "priority": 64, "tier": "P1", "why": ["Critical severity", "Public exploit reference", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.67087, "pinned": false, "pocs": [{"kind": "writeup", "name": "github.com/Zeecka/AperiSolve/pull/195", "url": "https://github.com/Zeecka/AperiSolve/pull/195"}, {"kind": "writeup", "name": "github.com/Zeecka/AperiSolve/security/advisories/GHSA-8r22-62p7-9jrp", "url": "https://github.com/Zeecka/AperiSolve/security/advisories/GHSA-8r22-62p7-9jrp"}], "ssvc": {"exploitation": "poc", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "python-openslide", "status": "fixed", "fixed": "1.4.7-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-336bea884e", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-336bea884e", "note": "FEDORA-2026-336bea884e"}, {"os": "Fedora ELN", "pkg": "valgrind", "status": "fixed", "fixed": "3.28.0-1.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-c593ef1d15", "note": "FEDORA-2026-c593ef1d15"}], "vendors_checked": "2026-10-24T04:31:13.918852+00:00", "vendor_fixed": true}, {"id": "CVE-2026-20079", "publisher": "Cisco Systems, Inc.", "title": "Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability", "summary": "A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.&nbsp;\r\n\r\nThis vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to a", "cvss": 10.0, "sev": "CRITICAL", "epss": 0.88472, "kev": true, "added": "2026-03-04", "pub": "2026-03-04T18:16:24.230", "modified": "2026-09-16T17:17:16.340", "products": [{"name": "secure firewall management center", "vendor": "cisco", "type": "app", "affected": ["7.0.0", "7.0.0.1", "7.0.1", "7.0.1.1", "7.0.2", "7.0.2.1", "7.0.3", "7.0.4"], "fixed": null, "safe": "before 7.0.0", "action": "downgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy secure-firewall-management-center || rpm -q secure-firewall-management-center || secure-firewall-management-center --version"}, {"label": "2. No fixed release: DOWNGRADE to a release before 7.0.0 (Debian / Ubuntu)", "cmd": "apt-cache madison secure-firewall-management-center\nsudo apt install secure-firewall-management-center=<VERSION_BEFORE_7.0.0>\nsudo apt-mark hold secure-firewall-management-center"}, {"label": "2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list secure-firewall-management-center\nsudo dnf downgrade secure-firewall-management-center-<VERSION_BEFORE_7.0.0>\nsudo dnf versionlock add secure-firewall-management-center"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-20079"}, {"t": "Vendor Advisory", "u": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2"}], "cwe": ["CWE-288"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-09-12", "kev_added": "2026-09-09", "ransom": false, "priority": 98, "tier": "P0", "why": ["Critical severity", "EPSS top 1%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.99774, "pocs": [{"kind": "poc", "name": "CyberAuth/CVE-2026-20079 (6 stars)", "url": "https://github.com/CyberAuth/CVE-2026-20079", "stars": 6}, {"kind": "poc", "name": "0xBlackash/CVE-2026-20079 (0 stars)", "url": "https://github.com/0xBlackash/CVE-2026-20079", "stars": 0}, {"kind": "poc", "name": "DiegoArias008/CVE-2026-20079-checker (0 stars)", "url": "https://github.com/DiegoArias008/CVE-2026-20079-checker", "stars": 0}, {"kind": "msf", "name": "Cisco Secure Firewall Management Center Authentication Bypass RCE", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/cisco_fmc_auth_bypass_rce.rb"}, {"kind": "nuclei", "name": "Cisco Secure Firewall Management Center - Authentication Bypass", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-20079.yaml"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true}, {"id": "CVE-2026-21962", "publisher": "Oracle", "title": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability", "summary": "Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Serv", "cvss": 10.0, "sev": "CRITICAL", "epss": 0.73192, "kev": true, "added": "2026-01-20", "pub": "2026-01-20T22:15:59.110", "modified": "2026-08-25T04:18:11.067", "products": [{"name": "http server", "vendor": "oracle", "type": "app", "affected": ["12.2.1.4.0", "14.1.1.0.0", "14.1.2.0.0"], "fixed": null, "safe": "before 12.2.1.4.0", "action": "downgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy http-server || rpm -q http-server || http-server --version"}, {"label": "2. No fixed release: DOWNGRADE to a release before 12.2.1.4.0 (Debian / Ubuntu)", "cmd": "apt-cache madison http-server\nsudo apt install http-server=<VERSION_BEFORE_12.2.1.4.0>\nsudo apt-mark hold http-server"}, {"label": "2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list http-server\nsudo dnf downgrade http-server-<VERSION_BEFORE_12.2.1.4.0>\nsudo dnf versionlock add http-server"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "weblogic server proxy plug-in", "vendor": "oracle", "type": "app", "affected": ["12.2.1.4.0", "14.1.1.0.0", "14.1.2.0.0"], "fixed": null, "safe": "before 12.2.1.4.0", "action": "downgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy weblogic-server-proxy-plug-in || rpm -q weblogic-server-proxy-plug-in || weblogic-server-proxy-plug-in --version"}, {"label": "2. No fixed release: DOWNGRADE to a release before 12.2.1.4.0 (Debian / Ubuntu)", "cmd": "apt-cache madison weblogic-server-proxy-plug-in\nsudo apt install weblogic-server-proxy-plug-in=<VERSION_BEFORE_12.2.1.4.0>\nsudo apt-mark hold weblogic-server-proxy-plug-in"}, {"label": "2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list weblogic-server-proxy-plug-in\nsudo dnf downgrade weblogic-server-proxy-plug-in-<VERSION_BEFORE_12.2.1.4.0>\nsudo dnf versionlock add weblogic-server-proxy-plug-in"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2026-21962"}, {"t": "Patch, Vendor Advisory", "u": "https://www.oracle.com/security-alerts/cpujan2026.html"}], "cwe": ["CWE-284"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-08-27", "kev_added": "2026-08-24", "ransom": false, "priority": 98, "tier": "P0", "why": ["Critical severity", "EPSS top 1%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.9946, "pinned": false, "pocs": [{"kind": "poc", "name": "samael0x4/CVE-2026-21962 (6 stars)", "url": "https://github.com/samael0x4/CVE-2026-21962", "stars": 6}, {"kind": "poc", "name": "boroeurnprach/Ashwesker-CVE-2026-21962 (6 stars)", "url": "https://github.com/boroeurnprach/Ashwesker-CVE-2026-21962", "stars": 6}, {"kind": "poc", "name": "gregk4sec/cve-2026-21962 (4 stars)", "url": "https://github.com/gregk4sec/cve-2026-21962", "stars": 4}, {"kind": "writeup", "name": "x.com/0xacb/status/2015473216844620280", "url": "https://x.com/0xacb/status/2015473216844620280"}], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true}, {"id": "CVE-2025-25249", "publisher": "Fortinet, Inc.", "title": "Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability", "summary": "A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets", "cvss": 8.1, "sev": "HIGH", "epss": 0.03802, "kev": true, "added": "2026-01-13", "pub": "2026-01-13T17:15:56.910", "modified": "2026-10-07T18:17:13.180", "products": [{"name": "fortios", "vendor": "fortinet", "type": "os", "affected": [">= 6.4.0 and < 7.0.18", ">= 7.2.0 and < 7.2.12", ">= 7.4.0 and < 7.4.9", ">= 7.6.0 and < 7.6.4"], "fixed": "7.0.18, 7.2.12, 7.4.9, 7.6.4", "safe": "before 6.4.0", "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "fortiswitchmanager", "vendor": "fortinet", "type": "app", "affected": [">= 7.0.0 and < 7.0.6", ">= 7.2.0 and < 7.2.7"], "fixed": "7.0.6, 7.2.7", "safe": "before 7.0.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy fortiswitchmanager || rpm -q fortiswitchmanager || fortiswitchmanager --version"}, {"label": "2. UPGRADE to 7.0.6 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade fortiswitchmanager"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade fortiswitchmanager"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 7.0.0 (Debian / Ubuntu)", "cmd": "apt-cache madison fortiswitchmanager\nsudo apt install fortiswitchmanager=<VERSION_BEFORE_7.0.0>\nsudo apt-mark hold fortiswitchmanager"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list fortiswitchmanager\nsudo dnf downgrade fortiswitchmanager-<VERSION_BEFORE_7.0.0>\nsudo dnf versionlock add fortiswitchmanager"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "fortisase", "vendor": "fortinet", "type": "app", "affected": ["25.1.39", "25.1.51"], "fixed": null, "safe": "before 25.1.39", "action": "downgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy fortisase || rpm -q fortisase || fortisase --version"}, {"label": "2. No fixed release: DOWNGRADE to a release before 25.1.39 (Debian / Ubuntu)", "cmd": "apt-cache madison fortisase\nsudo apt install fortisase=<VERSION_BEFORE_25.1.39>\nsudo apt-mark hold fortisase"}, {"label": "2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list fortisase\nsudo dnf downgrade fortisase-<VERSION_BEFORE_25.1.39>\nsudo dnf versionlock add fortisase"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "ruggedcom ape1808 firmware", "vendor": "siemens", "type": "os", "affected": ["all versions"], "fixed": null, "safe": null, "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2025-25249"}, {"t": "Mitigation, Vendor Advisory", "u": "https://fortiguard.fortinet.com/psirt/FG-IR-25-084"}], "cwe": ["CWE-122", "CWE-787"], "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-09-12", "kev_added": "2026-09-09", "ransom": false, "priority": 86, "tier": "P0", "why": ["High severity", "Exploited in the wild (CISA KEV)", "Public exploit reference", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.8997, "pinned": false, "pocs": [], "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true}, {"id": "CVE-2025-39964", "publisher": "kernel.org", "title": "Linux Kernel Race Condition Vulnerability", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Disallow concurrent writes in af_alg_sendmsg\n\nIssuing two writes to the same af_alg socket is bogus as the\ndata will be interleaved in an unpredictable fashion.  Furthermore,\nconcurrent writes may create inconsistencies in the internal\nsocket state.\n\nDisallow this by adding a new ctx->write field that indiciates\nexclusive ownership for writing.", "cvss": 7.8, "sev": "HIGH", "epss": 0.01362, "kev": true, "added": "2025-10-13", "pub": "2025-10-13T14:15:34.737", "modified": "2026-10-19T21:10:00.160", "products": [{"name": "linux kernel", "vendor": "linux", "type": "os", "affected": [">= 2.6.38 and < 5.10.245", ">= 5.11 and < 5.15.194", ">= 5.16 and < 6.1.154", ">= 6.2 and < 6.6.108", ">= 6.7 and < 6.12.49", ">= 6.13 and < 6.16.9", "6.17 rc1", "6.17 rc2"], "fixed": "5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, 6.16.9", "safe": null, "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "simatic s7-1500 cpu 1518-4 pn\\/dp mfp firmware", "vendor": "siemens", "type": "os", "affected": [">= 3.1.6"], "fixed": null, "safe": "before 3.1.6", "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "simatic s7-1500 cpu 1518f-4 pn\\/dp mfp firmware", "vendor": "siemens", "type": "os", "affected": [">= 3.1.6"], "fixed": null, "safe": "before 3.1.6", "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2025-39964"}, {"t": "Patch", "u": "https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce"}, {"t": "Patch", "u": "https://git.kernel.org/stable/c/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285"}, {"t": "Patch", "u": "https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8"}, {"t": "Patch", "u": "https://git.kernel.org/stable/c/45bcf60fe49b37daab1acee57b27211ad1574042"}, {"t": "Patch", "u": "https://git.kernel.org/stable/c/7c4491b5644e3a3708f3dbd7591be0a570135b84"}, {"t": "Patch", "u": "https://git.kernel.org/stable/c/9aee87da5572b3a14075f501752e209801160d3d"}], "cwe": ["CWE-362"], "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "L", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": "2026-09-21", "kev_added": "2026-09-18", "ransom": false, "priority": 75, "tier": "P0", "why": ["High severity", "Exploited in the wild (CISA KEV)", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.71568, "pinned": false, "pocs": [{"kind": "poc", "name": "n1k0oowang/CVE-2025-39964_EXP (3 stars)", "url": "https://github.com/n1k0oowang/CVE-2025-39964_EXP", "stars": 3}, {"kind": "poc", "name": "suominen/CVE-2025-39964 (0 stars)", "url": "https://github.com/suominen/CVE-2025-39964", "stars": 0}, {"kind": "writeup", "name": "cert-portal.siemens.com/productcert/html/ssa-019113.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}, {"kind": "writeup", "name": "cert-portal.siemens.com/productcert/html/ssa-457936.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}], "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}, {"os": "Ubuntu 20.04", "pkg": "linux", "status": "fixed", "fixed": "5.4.0-224.244", "cmd": "sudo apt update && sudo apt install --only-upgrade linux\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' linux)\" ge \"5.4.0-224.244\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Ubuntu 22.04", "pkg": "linux", "status": "fixed", "fixed": "5.15.0-164.174", "cmd": "sudo apt update && sudo apt install --only-upgrade linux\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' linux)\" ge \"5.15.0-164.174\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Ubuntu 25.10", "pkg": "linux", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Ubuntu 24.04", "pkg": "linux", "status": "fixed", "fixed": "6.8.0-90.91", "cmd": "sudo apt update && sudo apt install --only-upgrade linux\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' linux)\" ge \"6.8.0-90.91\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Ubuntu 25.04", "pkg": "linux", "status": "fixed", "fixed": "6.14.0-37.37", "cmd": "sudo apt update && sudo apt install --only-upgrade linux\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' linux)\" ge \"6.14.0-37.37\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Debian 12", "pkg": "linux", "status": "fixed", "fixed": "6.1.158-1", "cmd": "sudo apt update && sudo apt install --only-upgrade linux\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' linux)\" ge \"6.1.158-1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Debian 13", "pkg": "linux", "status": "fixed", "fixed": "6.12.57-1", "cmd": "sudo apt update && sudo apt install --only-upgrade linux\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' linux)\" ge \"6.12.57-1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "RHEL 10", "pkg": "kernel", "status": "fixed", "fixed": "kernel-6.12.0-211.58.1.el10_2", "cmd": "sudo dnf upgrade --advisory=RHSA-2026:70498\nrpm -q kernel", "url": null, "note": null}, {"os": "RHEL 10.0 Extended Update Support", "pkg": "kernel", "status": "fixed", "fixed": "kernel-6.12.0-55.106.1.el10_0", "cmd": "sudo dnf upgrade --advisory=RHSA-2026:71326\nrpm -q kernel", "url": null, "note": null}, {"os": "RHEL 7 Extended Lifecycle Support", "pkg": "kernel-rt", "status": "fixed", "fixed": "kernel-rt-3.10.0-1160.164.1.rt56.1316.el7", "cmd": "sudo dnf upgrade --advisory=RHSA-2026:71657\nrpm -q kernel-rt", "url": null, "note": null}, {"os": "RHEL 7 Extended Lifecycle Support", "pkg": "kernel", "status": "fixed", "fixed": "kernel-3.10.0-1160.164.1.el7", "cmd": "sudo dnf upgrade --advisory=RHSA-2026:71687\nrpm -q kernel", "url": null, "note": null}, {"os": "RHEL 8", "pkg": "kernel-rt", "status": "fixed", "fixed": "kernel-rt-4.18.0-553.166.1.rt7.507.el8_10", "cmd": "sudo dnf upgrade --advisory=RHSA-2026:70403\nrpm -q kernel-rt", "url": null, "note": null}, {"os": "Amazon Linux 2023", "pkg": "see advisory", "status": "fixed", "fixed": null, "cmd": "sudo dnf update --advisory=ALAS2023-2025-1254", "url": "https://alas.aws.amazon.com/cve/html/CVE-2025-39964.html", "note": "ALAS2023-2025-1254"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true}, {"id": "CVE-2025-39682", "publisher": "kernel.org", "title": "Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix handling of zero-length records on the rx_list\n\nEach recvmsg() call must process either\n - only contiguous DATA records (any number of them)\n - one non-DATA record\n\nIf the next record has different type than what has already been\nprocessed we break out of the main processing loop. If the record\nhas already been decrypted (which may be the case for TLS 1.3 where\nwe don't", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.0288, "kev": true, "added": "2025-09-05", "pub": "2025-09-05T18:15:44.670", "modified": "2026-10-19T21:10:00.160", "products": [{"name": "linux kernel", "vendor": "linux", "type": "os", "affected": [">= 6.0 and < 6.1.149", ">= 6.2 and < 6.6.103", ">= 6.7 and < 6.12.44", ">= 6.13 and < 6.16.4", "6.17 rc1", "6.17 rc2"], "fixed": "6.1.149, 6.6.103, 6.12.44, 6.16.4", "safe": null, "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "debian linux", "vendor": "debian", "type": "os", "affected": ["11.0"], "fixed": null, "safe": "before 11.0", "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "simatic cn 4100 firmware", "vendor": "siemens", "type": "os", "affected": ["< 5.0"], "fixed": "5.0", "safe": null, "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2025-39682"}, {"t": "Patch", "u": "https://git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f"}, {"t": "Patch", "u": "https://git.kernel.org/stable/c/29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e"}, {"t": "Patch", "u": "https://git.kernel.org/stable/c/3439c15ae91a517cf3c650ea15a8987699416ad9"}, {"t": "Patch", "u": "https://git.kernel.org/stable/c/62708b9452f8eb77513115b17c4f8d1a22ebf843"}, {"t": "Patch", "u": "https://git.kernel.org/stable/c/c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677"}], "cwe": ["CWE-754"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-09-21", "kev_added": "2026-09-18", "ransom": false, "priority": 99, "tier": "P0", "why": ["Critical severity", "Exploited in the wild (CISA KEV)", "Public exploit reference", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.86761, "pinned": false, "pocs": [{"kind": "poc", "name": "khoatran107/cve-2025-39682 (6 stars)", "url": "https://github.com/khoatran107/cve-2025-39682", "stars": 6}, {"kind": "poc", "name": "suominen/CVE-2025-39682 (0 stars)", "url": "https://github.com/suominen/CVE-2025-39682", "stars": 0}], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}, {"os": "Debian 12", "pkg": "linux", "status": "fixed", "fixed": "6.1.153-1", "cmd": "sudo apt update && sudo apt install --only-upgrade linux\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' linux)\" ge \"6.1.153-1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Debian 13", "pkg": "linux", "status": "fixed", "fixed": "6.12.48-1", "cmd": "sudo apt update && sudo apt install --only-upgrade linux\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' linux)\" ge \"6.12.48-1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "RHEL 10", "pkg": "kernel", "status": "fixed", "fixed": "kernel-6.12.0-55.37.1.el10_0", "cmd": "sudo dnf upgrade --advisory=RHSA-2025:16904\nrpm -q kernel", "url": null, "note": null}, {"os": "RHEL 9", "pkg": "kernel", "status": "fixed", "fixed": "kernel-5.14.0-570.49.1.el9_6", "cmd": "sudo dnf upgrade --advisory=RHSA-2025:16880\nrpm -q kernel", "url": null, "note": null}, {"os": "RHEL 9.2 Update Services for SAP Solutions", "pkg": "kernel", "status": "fixed", "fixed": "kernel-5.14.0-284.144.1.el9_2", "cmd": "sudo dnf upgrade --advisory=RHSA-2025:19224\nrpm -q kernel", "url": null, "note": null}, {"os": "RHEL 9.2 Update Services for SAP Solutions", "pkg": "kernel-rt", "status": "fixed", "fixed": "kernel-rt-5.14.0-284.144.1.rt14.429.el9_2", "cmd": "sudo dnf upgrade --advisory=RHSA-2025:19223\nrpm -q kernel-rt", "url": null, "note": null}, {"os": "RHEL 9.4 Extended Update Support", "pkg": "kernel", "status": "fixed", "fixed": "kernel-5.14.0-427.96.1.el9_4", "cmd": "sudo dnf upgrade --advisory=RHSA-2025:19104\nrpm -q kernel", "url": null, "note": null}, {"os": "Amazon Linux 2023", "pkg": "see advisory", "status": "fixed", "fixed": null, "cmd": "sudo dnf update --advisory=ALAS2023-2025-1208", "url": "https://alas.aws.amazon.com/cve/html/CVE-2025-39682.html", "note": "ALAS2023-2025-1208"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true}, {"id": "CVE-2025-6424", "publisher": "Mozilla Corporation", "title": "A use-after-free in FontFaceSet resulted in a potentially exploitable crash", "summary": "A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.0439, "kev": false, "added": "2025-06-24", "pub": "2025-06-24T13:15:23.273", "modified": "2026-10-23T22:10:00.160", "products": [{"name": "firefox", "vendor": "mozilla", "type": "app", "affected": ["< 115.25.0", "< 140.0", ">= 116.0 and < 128.12.0"], "fixed": "115.25.0, 128.12.0, 140.0", "safe": "before 116.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy firefox || rpm -q firefox || firefox --version"}, {"label": "2. UPGRADE to 115.25.0 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade firefox"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade firefox"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 116.0 (Debian / Ubuntu)", "cmd": "apt-cache madison firefox\nsudo apt install firefox=<VERSION_BEFORE_116.0>\nsudo apt-mark hold firefox"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list firefox\nsudo dnf downgrade firefox-<VERSION_BEFORE_116.0>\nsudo dnf versionlock add firefox"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2025-6424"}, {"t": "Vendor Advisory", "u": "https://www.mozilla.org/security/advisories/mfsa2025-51/"}, {"t": "Vendor Advisory", "u": "https://www.mozilla.org/security/advisories/mfsa2025-52/"}, {"t": "Vendor Advisory", "u": "https://www.mozilla.org/security/advisories/mfsa2025-53/"}], "cwe": ["CWE-416"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": false, "kev_due": null, "kev_added": null, "ransom": false, "priority": 65, "tier": "P1", "why": ["Critical severity", "EPSS top 9%: very likely to be exploited", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.91276, "vendors": [{"os": "Fedora 46", "pkg": "pspp", "status": "fixed", "fixed": "2.1.3-2.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0d6444911b", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d6444911b", "note": "FEDORA-2026-0d6444911b"}, {"os": "Fedora ELN", "pkg": "barman", "status": "fixed", "fixed": "3.20.1-3.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-45ecf042c2", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ecf042c2", "note": "FEDORA-2026-45ecf042c2"}, {"os": "Ubuntu 22.04", "pkg": "firefox", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Ubuntu 24.04", "pkg": "firefox", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Ubuntu 24.10", "pkg": "firefox", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Ubuntu 25.04", "pkg": "firefox", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Ubuntu 25.10", "pkg": "firefox", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Debian 12", "pkg": "firefox-esr", "status": "fixed", "fixed": "128.12.0esr-1~deb12u1", "cmd": "sudo apt update && sudo apt install --only-upgrade firefox-esr\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' firefox-esr)\" ge \"128.12.0esr-1~deb12u1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Debian 13", "pkg": "firefox-esr", "status": "fixed", "fixed": "128.12.0esr-1", "cmd": "sudo apt update && sudo apt install --only-upgrade firefox-esr\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' firefox-esr)\" ge \"128.12.0esr-1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Debian 12", "pkg": "thunderbird", "status": "fixed", "fixed": "1:128.12.0esr-1~deb12u1", "cmd": "sudo apt update && sudo apt install --only-upgrade thunderbird\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' thunderbird)\" ge \"1:128.12.0esr-1~deb12u1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Debian 13", "pkg": "thunderbird", "status": "fixed", "fixed": "1:128.12.0esr-1", "cmd": "sudo apt update && sudo apt install --only-upgrade thunderbird\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' thunderbird)\" ge \"1:128.12.0esr-1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "RHEL 10", "pkg": "firefox", "status": "fixed", "fixed": "firefox-128.12.0-1.el10_0", "cmd": "sudo dnf upgrade --advisory=RHSA-2025:10073\nrpm -q firefox", "url": null, "note": null}, {"os": "RHEL 10", "pkg": "thunderbird", "status": "fixed", "fixed": "thunderbird-128.12.0-1.el10_0", "cmd": "sudo dnf upgrade --advisory=RHSA-2025:10195\nrpm -q thunderbird", "url": null, "note": null}, {"os": "RHEL 7 Extended Lifecycle Support", "pkg": "firefox", "status": "fixed", "fixed": "firefox-128.12.0-1.el7_9", "cmd": "sudo dnf upgrade --advisory=RHSA-2025:10181\nrpm -q firefox", "url": null, "note": null}, {"os": "RHEL 8", "pkg": "firefox", "status": "fixed", "fixed": "firefox-128.12.0-1.el8_10", "cmd": "sudo dnf upgrade --advisory=RHSA-2025:10074\nrpm -q firefox", "url": null, "note": null}, {"os": "RHEL 8", "pkg": "thunderbird", "status": "fixed", "fixed": "thunderbird-128.12.0-1.el8_10", "cmd": "sudo dnf upgrade --advisory=RHSA-2025:10246\nrpm -q thunderbird", "url": null, "note": null}, {"os": "Amazon Linux 2023", "pkg": "see advisory", "status": "fixed", "fixed": null, "cmd": "sudo dnf update --advisory=ALAS2023-2025-1055", "url": "https://alas.aws.amazon.com/cve/html/CVE-2025-6424.html", "note": "ALAS2023-2025-1055"}], "vendors_checked": "2026-10-23T23:09:01.822238+00:00", "vendor_fixed": true, "pocs": [{"kind": "writeup", "name": "bugzilla.mozilla.org/show_bug.cgi?id=1966423", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1966423"}], "ssvc": {"exploitation": "none", "automatable": "yes", "impact": "total"}, "pinned": false}, {"id": "CVE-2024-21762", "publisher": "Fortinet, Inc.", "title": "Fortinet FortiOS Out-of-Bound Write Vulnerability", "summary": "A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiOS 6.0 all versions, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8, FortiProxy 7.0.0 through 7.0.14, FortiProxy 2.0.0 through 2.0.13, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiPr", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.83428, "kev": true, "added": "2024-02-09", "modified": "2026-10-22T19:20:41.990", "products": [{"name": "fortiproxy", "vendor": "fortinet", "type": "app", "affected": [">= 1.0.0 and < 2.0.14", ">= 7.0.0 and < 7.0.15", ">= 7.2.0 and < 7.2.9", ">= 7.4.0 and < 7.4.3"], "fixed": "2.0.14, 7.0.15, 7.2.9, 7.4.3", "safe": "before 1.0.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy fortiproxy || rpm -q fortiproxy || fortiproxy --version"}, {"label": "2. UPGRADE to 2.0.14 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade fortiproxy"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade fortiproxy"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 1.0.0 (Debian / Ubuntu)", "cmd": "apt-cache madison fortiproxy\nsudo apt install fortiproxy=<VERSION_BEFORE_1.0.0>\nsudo apt-mark hold fortiproxy"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list fortiproxy\nsudo dnf downgrade fortiproxy-<VERSION_BEFORE_1.0.0>\nsudo dnf versionlock add fortiproxy"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "fortios", "vendor": "fortinet", "type": "os", "affected": [">= 6.0.0 and < 6.0.18", ">= 6.2.0 and < 6.2.16", ">= 6.4.0 and < 6.4.15", ">= 7.0.0 and < 7.0.14", ">= 7.2.0 and < 7.2.7", ">= 7.4.0 and < 7.4.3"], "fixed": "6.0.18, 6.2.16, 6.4.15, 7.0.14, 7.2.7, 7.4.3", "safe": "before 6.0.0", "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2024-21762"}, {"t": "Vendor Advisory", "u": "https://fortiguard.com/psirt/FG-IR-24-015"}, {"t": "Vendor Advisory", "u": "https://fortiguard.com/psirt/FG-IR-24-015"}], "cwe": ["CWE-787"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2024-02-16", "kev_added": "2024-02-09", "ransom": true, "priority": 100, "tier": "P0", "why": ["Critical severity", "EPSS top 1%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Used in ransomware campaigns", "Public exploit reference", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.99685, "pinned": false, "pocs": [{"kind": "poc", "name": "h4x0r-dz/CVE-2024-21762 (150 stars)", "url": "https://github.com/h4x0r-dz/CVE-2024-21762", "stars": 150}, {"kind": "poc", "name": "BishopFox/cve-2024-21762-check (107 stars)", "url": "https://github.com/BishopFox/cve-2024-21762-check", "stars": 107}, {"kind": "poc", "name": "r4p3c4/CVE-2024-21762-Exploit-PoC-Fortinet-SSL-VPN-Check (16 stars)", "url": "https://github.com/r4p3c4/CVE-2024-21762-Exploit-PoC-Fortinet-SSL-VPN-Check", "stars": 16}, {"kind": "poc", "name": "AlexLondan/CVE-2024-21762-Fortinet-RCE-ALLWORK", "url": "https://github.com/AlexLondan/CVE-2024-21762-Fortinet-RCE-ALLWORK", "stars": 0}], "vendors": [{"os": "Fedora 46", "pkg": "python-streamlink", "status": "fixed", "fixed": "8.6.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-a56fcfdc08", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-a56fcfdc08", "note": "FEDORA-2026-a56fcfdc08"}, {"os": "Fedora ELN", "pkg": "valgrind", "status": "fixed", "fixed": "3.28.0-1.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-c593ef1d15", "note": "FEDORA-2026-c593ef1d15"}], "vendors_checked": "2026-10-24T06:05:19.655601+00:00", "vendor_fixed": true, "mentions": [{"src": "CERT-FR Alerts", "group": "gov", "title": "[M\u00e0J] Vuln\u00e9rabilit\u00e9 dans Fortinet FortiOS (09 f\u00e9vrier 2024)", "url": "https://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-004/", "date": "2024-02-09"}], "buzz": 1, "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}}, {"id": "CVE-2023-49105", "publisher": "MITRE", "title": "ownCloud Improper Authentication Vulnerability", "summary": "An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.4319, "kev": true, "added": "2023-11-21", "pub": "2023-11-21T22:15:08.613", "modified": "2026-08-28T12:21:09.753", "products": [{"name": "owncloud server", "vendor": "owncloud", "type": "app", "affected": [">= 10.6.0 and < 10.13.1"], "fixed": "10.13.1", "safe": "before 10.6.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy owncloud-server || rpm -q owncloud-server || owncloud-server --version"}, {"label": "2. UPGRADE to 10.13.1 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade owncloud-server"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade owncloud-server"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 10.6.0 (Debian / Ubuntu)", "cmd": "apt-cache madison owncloud-server\nsudo apt install owncloud-server=<VERSION_BEFORE_10.6.0>\nsudo apt-mark hold owncloud-server"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list owncloud-server\nsudo dnf downgrade owncloud-server-<VERSION_BEFORE_10.6.0>\nsudo dnf versionlock add owncloud-server"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2023-49105"}, {"t": "Vendor Advisory", "u": "https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/"}, {"t": "Vendor Advisory", "u": "https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/"}], "cwe": ["CWE-287"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-08-30", "kev_added": "2026-08-27", "ransom": false, "priority": 97, "tier": "P0", "why": ["Critical severity", "EPSS top 1%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.98725, "pinned": false, "pocs": [{"kind": "poc", "name": "ambionics/owncloud-exploits (41 stars)", "url": "https://github.com/ambionics/owncloud-exploits", "stars": 41}], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true}, {"id": "CVE-2023-22894", "publisher": "MITRE", "title": "Strapi Cleartext Storage of Sensitive Information Vulnerability", "summary": "Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with perm", "cvss": 4.9, "sev": "MEDIUM", "epss": 0.03609, "kev": true, "added": "2023-04-19", "pub": "2023-04-19T16:15:07.303", "modified": "2026-10-09T14:20:41.113", "products": [{"name": "strapi", "vendor": "strapi", "type": "app", "affected": [">= 3.2.1 and < 4.8.0"], "fixed": "4.8.0", "safe": "before 3.2.1", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy strapi || rpm -q strapi || strapi --version"}, {"label": "2. UPGRADE to 4.8.0 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade strapi"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade strapi"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 3.2.1 (Debian / Ubuntu)", "cmd": "apt-cache madison strapi\nsudo apt install strapi=<VERSION_BEFORE_3.2.1>\nsudo apt-mark hold strapi"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list strapi\nsudo dnf downgrade strapi-<VERSION_BEFORE_3.2.1>\nsudo dnf versionlock add strapi"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2023-22894"}, {"t": "Exploit, Vendor Advisory", "u": "https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve"}, {"t": "Exploit, Vendor Advisory", "u": "https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve"}], "cwe": ["CWE-312"], "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "attack": {"av": "N", "ac": "L", "pr": "H", "ui": "N"}, "remote": false, "exploit": true, "kev_due": "2026-10-11", "kev_added": "2026-10-08", "ransom": false, "priority": 70, "tier": "P0", "why": ["Exploited in the wild (CISA KEV)", "Public exploit reference"], "fix": true, "watched": false, "epss_pct": 0.89437, "pinned": false, "pocs": [{"kind": "poc", "name": "Saboor-Hakimi/CVE-2023-22894 (13 stars)", "url": "https://github.com/Saboor-Hakimi/CVE-2023-22894", "stars": 13}, {"kind": "poc", "name": "maxntv/CVE-2023-22894-PoC (0 stars)", "url": "https://github.com/maxntv/CVE-2023-22894-PoC", "stars": 0}, {"kind": "writeup", "name": "github.com/strapi/strapi/releases", "url": "https://github.com/strapi/strapi/releases"}, {"kind": "writeup", "name": "strapi.io/blog/security-disclosure-of-vulnerabilities-cve", "url": "https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve"}, {"kind": "writeup", "name": "www.ghostccamm.com/blog/multi_strapi_vulns/", "url": "https://www.ghostccamm.com/blog/multi_strapi_vulns/"}, {"kind": "poc", "name": "maxntv24/CVE-2023-22894-PoC", "url": "https://github.com/maxntv24/CVE-2023-22894-PoC", "stars": 0}], "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "npm", "pkg": "@strapi/strapi", "status": "fixed", "fixed": "4.8.0", "cmd": "npm install @strapi/strapi@\">=4.8.0\"\nnpm ls @strapi/strapi", "url": "https://github.com/advisories/GHSA-jjqf-j4w7-92w8", "note": "vulnerable: >= 3.2.1, < 4.8.0"}, {"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:12:18.499908+00:00", "vendor_fixed": true}, {"id": "CVE-2022-0995", "publisher": "Red Hat, Inc.", "title": "Linux Kernel Out-of-Bounds Write Vulnerability", "summary": "An out-of-bounds (OOB) memory write flaw was found in the Linux kernel\u2019s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system.", "cvss": 7.8, "sev": "HIGH", "epss": 0.08859, "kev": true, "added": "2022-03-25", "pub": "2022-03-25T19:15:10.520", "modified": "2026-08-27T04:16:39.223", "products": [{"name": "linux kernel", "vendor": "linux", "type": "os", "affected": [">= 5.8 and < 5.10.106", ">= 5.11 and < 5.15.29", ">= 5.16 and < 5.16.5", "5.17 rc1", "5.17 rc2", "5.17 rc3", "5.17 rc4", "5.17 rc5"], "fixed": "5.10.106, 5.15.29, 5.16.5", "safe": null, "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "fedora", "vendor": "fedoraproject", "type": "os", "affected": ["35"], "fixed": null, "safe": "before 35", "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "h300e firmware", "vendor": "netapp", "type": "os", "affected": ["all versions"], "fixed": null, "safe": null, "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "h300s firmware", "vendor": "netapp", "type": "os", "affected": ["all versions"], "fixed": null, "safe": null, "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "h410c firmware", "vendor": "netapp", "type": "os", "affected": ["all versions"], "fixed": null, "safe": null, "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "h410s firmware", "vendor": "netapp", "type": "os", "affected": ["all versions"], "fixed": null, "safe": null, "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2022-0995"}, {"t": "Issue Tracking, Patch", "u": "https://bugzilla.redhat.com/show_bug.cgi?id=2063786"}, {"t": "Patch, Vendor Advisory", "u": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=93ce93587d36493f2f86921fa79921b3cba63fbb"}, {"t": "Issue Tracking, Patch", "u": "https://bugzilla.redhat.com/show_bug.cgi?id=2063786"}, {"t": "Patch, Vendor Advisory", "u": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=93ce93587d36493f2f86921fa79921b3cba63fbb"}], "cwe": ["CWE-787"], "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "L", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": true, "kev_due": "2026-08-29", "kev_added": "2026-08-26", "ransom": false, "priority": 86, "tier": "P0", "why": ["High severity", "EPSS top 5%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.95208, "pocs": [{"kind": "poc", "name": "Bonfee/CVE-2022-0995 (498 stars)", "url": "https://github.com/Bonfee/CVE-2022-0995", "stars": 498}, {"kind": "poc", "name": "1nzag/CVE-2022-0995 (2 stars)", "url": "https://github.com/1nzag/CVE-2022-0995", "stars": 2}, {"kind": "poc", "name": "AndreevSemen/CVE-2022-0995 (1 stars)", "url": "https://github.com/AndreevSemen/CVE-2022-0995", "stars": 1}, {"kind": "writeup", "name": "git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=93ce93587d36493f2f86", "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=93ce93587d36493f2f86921fa79921b3cba63fbb"}, {"kind": "poc", "name": "A1b2rt/cve-2022-0995", "url": "https://github.com/A1b2rt/cve-2022-0995", "stars": 0}, {"kind": "msf", "name": "Watch Queue Out of Bounds Write", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/cve_2022_0995_watch_queue.rb"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "python-streamlink", "status": "fixed", "fixed": "8.6.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-a56fcfdc08", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-a56fcfdc08", "note": "FEDORA-2026-a56fcfdc08"}, {"os": "Fedora ELN", "pkg": "valgrind", "status": "fixed", "fixed": "3.28.0-1.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-c593ef1d15", "note": "FEDORA-2026-c593ef1d15"}, {"os": "Ubuntu 20.04", "pkg": "linux", "status": "vulnerable", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Ubuntu 22.04", "pkg": "linux", "status": "fixed", "fixed": "5.15.0-138.148", "cmd": "sudo apt update && sudo apt install --only-upgrade linux\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' linux)\" ge \"5.15.0-138.148\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Ubuntu 24.04", "pkg": "linux", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Ubuntu 24.10", "pkg": "linux", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Ubuntu 25.04", "pkg": "linux", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Debian 12", "pkg": "linux", "status": "fixed", "fixed": "5.16.18-1", "cmd": "sudo apt update && sudo apt install --only-upgrade linux\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' linux)\" ge \"5.16.18-1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Debian 13", "pkg": "linux", "status": "fixed", "fixed": "5.16.18-1", "cmd": "sudo apt update && sudo apt install --only-upgrade linux\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' linux)\" ge \"5.16.18-1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "RHEL 6", "pkg": "kernel", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "RHEL 7", "pkg": "kernel", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "RHEL 7", "pkg": "kernel-rt", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "RHEL 8", "pkg": "kernel", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "RHEL 8", "pkg": "kernel-rt", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}], "vendors_checked": "2026-10-24T06:05:19.655601+00:00", "vendor_fixed": true}, {"id": "CVE-2021-23758", "publisher": "Snyk", "title": "Ajax.NET Professional Deserialization of Untrusted Data Vulnerability", "summary": "All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.", "cvss": 8.1, "sev": "HIGH", "epss": 0.82578, "kev": true, "added": "2021-12-03", "pub": "2021-12-03T20:15:07.557", "modified": "2026-08-27T04:16:38.863", "products": [{"name": "ajaxpro.2", "vendor": "ajaxpro.2 project", "type": "app", "affected": ["all versions"], "fixed": null, "safe": null, "action": "mitigate", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy ajaxpro.2 || rpm -q ajaxpro.2 || ajaxpro.2 --version"}, {"label": "No fixed or unaffected release known", "cmd": "Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access."}]}, {"name": "ajax.net professional", "vendor": "michaelschwarz", "type": "app", "affected": ["< 21.10.30.1"], "fixed": "21.10.30.1", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy ajax.net-professional || rpm -q ajax.net-professional || ajax.net-professional --version"}, {"label": "2. UPGRADE to 21.10.30.1 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade ajax.net-professional"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade ajax.net-professional"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2021-23758"}, {"t": "Patch, Third Party Advisory", "u": "https://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57"}, {"t": "Patch, Third Party Advisory", "u": "https://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57"}], "cwe": ["CWE-502"], "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-09-09", "kev_added": "2026-08-26", "ransom": false, "priority": 88, "tier": "P0", "why": ["High severity", "EPSS top 1%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.99666, "pocs": [{"kind": "poc", "name": "numanturle/CVE-2021-23758-POC (18 stars)", "url": "https://github.com/numanturle/CVE-2021-23758-POC", "stars": 18}, {"kind": "writeup", "name": "blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into", "url": "https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/"}, {"kind": "writeup", "name": "snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971", "url": "https://snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971"}, {"kind": "msf", "name": "AjaxPro Deserialization Remote Code Execution", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/ajaxpro_deserialization_rce.rb"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "NuGet (.NET)", "pkg": "AjaxNetProfessional", "status": "fixed", "fixed": "21.11.29.1", "cmd": "dotnet add package AjaxNetProfessional --version 21.11.29.1", "url": "https://github.com/advisories/GHSA-6r7c-6w96-8pvw", "note": "vulnerable: <= 21.11.29"}, {"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true}, {"id": "CVE-2021-3199", "publisher": "MITRE", "title": "ONLYOFFICE Docs Server Path Traversal Vulnerability", "summary": "Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.", "cvss": 9.8, "sev": "CRITICAL", "epss": 0.20136, "kev": true, "added": "2021-01-26", "pub": "2021-01-26T18:16:28.507", "modified": "2026-10-09T14:20:47.350", "products": [{"name": "document server", "vendor": "onlyoffice", "type": "app", "affected": ["< 5.6.3"], "fixed": "5.6.3", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy document-server || rpm -q document-server || document-server --version"}, {"label": "2. UPGRADE to 5.6.3 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade document-server"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade document-server"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2021-3199"}], "cwe": ["CWE-22"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-10-11", "kev_added": "2026-10-08", "ransom": false, "priority": 97, "tier": "P0", "why": ["Critical severity", "EPSS top 3%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action"], "fix": true, "watched": false, "epss_pct": 0.97454, "pinned": false, "pocs": [{"kind": "writeup", "name": "github.com/moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.py", "url": "https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.py"}, {"kind": "writeup", "name": "github.com/nola-milkin/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.py", "url": "https://github.com/nola-milkin/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.py"}], "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true}, {"id": "CVE-2019-1068", "publisher": "Microsoft Corporation", "title": "Microsoft SQL Server Remote Code Execution Vulnerability", "summary": "A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.", "cvss": 8.8, "sev": "HIGH", "epss": 0.57273, "kev": true, "added": "2019-07-15", "pub": "2019-07-15T19:15:16.983", "modified": "2026-08-27T04:16:38.583", "products": [{"name": "sql server", "vendor": "microsoft", "type": "app", "affected": ["2014 sp2", "2014 sp3"], "fixed": null, "safe": "before 2014", "action": "downgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy sql-server || rpm -q sql-server || sql-server --version"}, {"label": "2. No fixed release: DOWNGRADE to a release before 2014 (Debian / Ubuntu)", "cmd": "apt-cache madison sql-server\nsudo apt install sql-server=<VERSION_BEFORE_2014>\nsudo apt-mark hold sql-server"}, {"label": "2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list sql-server\nsudo dnf downgrade sql-server-<VERSION_BEFORE_2014>\nsudo dnf versionlock add sql-server"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "sql server 2016", "vendor": "microsoft", "type": "app", "affected": [">= 13.0.4001.0 and < 13.0.4259.0", ">= 13.0.4411.0 and < 13.0.4604.0", ">= 13.0.5026.0 and < 13.0.5101.9", ">= 13.0.5149.0 and < 13.0.5366.0"], "fixed": "13.0.4259.0, 13.0.4604.0, 13.0.5101.9, 13.0.5366.0", "safe": "before 13.0.4001.0", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy sql-server-2016 || rpm -q sql-server-2016 || sql-server-2016 --version"}, {"label": "2. UPGRADE to 13.0.4259.0 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade sql-server-2016"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade sql-server-2016"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 13.0.4001.0 (Debian / Ubuntu)", "cmd": "apt-cache madison sql-server-2016\nsudo apt install sql-server-2016=<VERSION_BEFORE_13.0.4001.0>\nsudo apt-mark hold sql-server-2016"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list sql-server-2016\nsudo dnf downgrade sql-server-2016-<VERSION_BEFORE_13.0.4001.0>\nsudo dnf versionlock add sql-server-2016"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "sql server 2017", "vendor": "microsoft", "type": "app", "affected": [">= 14.0.1000.169 and < 14.0.2027.2", ">= 14.0.3006.16 and < 14.0.3192.2"], "fixed": "14.0.2027.2, 14.0.3192.2", "safe": "before 14.0.1000.169", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy sql-server-2017 || rpm -q sql-server-2017 || sql-server-2017 --version"}, {"label": "2. UPGRADE to 14.0.2027.2 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade sql-server-2017"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade sql-server-2017"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 14.0.1000.169 (Debian / Ubuntu)", "cmd": "apt-cache madison sql-server-2017\nsudo apt install sql-server-2017=<VERSION_BEFORE_14.0.1000.169>\nsudo apt-mark hold sql-server-2017"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list sql-server-2017\nsudo dnf downgrade sql-server-2017-<VERSION_BEFORE_14.0.1000.169>\nsudo dnf versionlock add sql-server-2017"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2019-1068"}, {"t": "Patch, Vendor Advisory", "u": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068"}, {"t": "Patch, Vendor Advisory", "u": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068"}], "cwe": ["CWE-20"], "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": false, "kev_due": "2026-08-29", "kev_added": "2026-08-26", "ransom": false, "priority": 86, "tier": "P0", "why": ["High severity", "EPSS top 1%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.99076, "pinned": false, "pocs": [{"kind": "poc", "name": "Vulnerability-Playground/CVE-2019-1068 (1 stars)", "url": "https://github.com/Vulnerability-Playground/CVE-2019-1068", "stars": 1}], "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true}, {"id": "CVE-2016-3081", "publisher": "Red Hat, Inc.", "title": "Apache Struts Command Injection Vulnerability", "summary": "Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.", "cvss": 8.1, "sev": "HIGH", "epss": 0.96052, "kev": true, "added": "2016-04-26", "pub": "2016-04-26T14:59:02.207", "modified": "2026-10-09T14:43:05.703", "products": [{"name": "agile controller-campus firmware", "vendor": "huawei", "type": "os", "affected": ["v100r002c00"], "fixed": null, "safe": "before v100r002c00", "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "anyoffice", "vendor": "huawei", "type": "app", "affected": ["v200r005c00", "v200r006c00"], "fixed": null, "safe": "before v200r005c00", "action": "downgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy anyoffice || rpm -q anyoffice || anyoffice --version"}, {"label": "2. No fixed release: DOWNGRADE to a release before v200r005c00 (Debian / Ubuntu)", "cmd": "apt-cache madison anyoffice\nsudo apt install anyoffice=<VERSION_BEFORE_v200r005c00>\nsudo apt-mark hold anyoffice"}, {"label": "2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list anyoffice\nsudo dnf downgrade anyoffice-<VERSION_BEFORE_v200r005c00>\nsudo dnf versionlock add anyoffice"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "logcenter", "vendor": "huawei", "type": "app", "affected": ["v100r001c10", "v100r001c20"], "fixed": null, "safe": "before v100r001c10", "action": "downgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy logcenter || rpm -q logcenter || logcenter --version"}, {"label": "2. No fixed release: DOWNGRADE to a release before v100r001c10 (Debian / Ubuntu)", "cmd": "apt-cache madison logcenter\nsudo apt install logcenter=<VERSION_BEFORE_v100r001c10>\nsudo apt-mark hold logcenter"}, {"label": "2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list logcenter\nsudo dnf downgrade logcenter-<VERSION_BEFORE_v100r001c10>\nsudo dnf versionlock add logcenter"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}, {"name": "firehunter6000 firmware", "vendor": "huawei", "type": "os", "affected": ["v100r001c20"], "fixed": null, "safe": "before v100r001c20", "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "oceanstor 5300 v3 firmware", "vendor": "huawei", "type": "os", "affected": ["v300r001", "v300r002", "v300r003c00", "v300r003c10"], "fixed": null, "safe": "before v300r001", "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "oceanstor 5500 v3 firmware", "vendor": "huawei", "type": "os", "affected": ["v300r001", "v300r002", "v300r003c00", "v300r003c10"], "fixed": null, "safe": "before v300r001", "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2016-3081"}, {"t": "Patch, Third Party Advisory", "u": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html"}, {"t": "Patch, Vendor Advisory", "u": "https://struts.apache.org/docs/s2-032.html"}, {"t": "Patch, Third Party Advisory", "u": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html"}, {"t": "Patch, Vendor Advisory", "u": "https://struts.apache.org/docs/s2-032.html"}], "cwe": ["CWE-77"], "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "N", "ac": "H", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-10-11", "kev_added": "2026-10-08", "ransom": false, "priority": 93, "tier": "P0", "why": ["High severity", "EPSS top 1%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "Remotely exploitable, no login, no user action", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.99879, "pocs": [{"kind": "writeup", "name": "www.exploit-db.com/exploits/39756/", "url": "https://www.exploit-db.com/exploits/39756/"}, {"kind": "edb", "name": "Apache Struts - Dynamic Method Invocation Remote Code Execution (Metasploit)", "url": "https://www.exploit-db.com/exploits/39756"}, {"kind": "msf", "name": "Apache Struts Dynamic Method Invocation Remote Code Execution", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts_dmi_exec.rb"}, {"kind": "nuclei", "name": "Apache S2-032 Struts - Remote Code Execution", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-3081.yaml"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Maven", "pkg": "org.apache.struts:struts2-core", "status": "fixed", "fixed": "2.3.20.3", "cmd": "Set org.apache.struts:struts2-core to 2.3.20.3 or later in pom.xml or build.gradle, then rebuild and redeploy.", "url": "https://github.com/advisories/GHSA-8c6j-ffmf-q6vm", "note": "vulnerable: >= 2.3.19, <= 2.3.20.2"}, {"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true}, {"id": "CVE-2015-5287", "publisher": "Red Hat, Inc.", "title": "Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability", "summary": "The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.", "cvss": 7.8, "sev": "HIGH", "epss": 0.05003, "kev": true, "added": "2015-12-07", "pub": "2015-12-07T18:59:02.230", "modified": "2026-08-27T04:16:38.280", "products": [{"name": "automatic bug reporting tool", "vendor": "redhat", "type": "app", "affected": ["<= 2.7.0"], "fixed": "newer than 2.7.0", "safe": null, "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy automatic-bug-reporting-tool || rpm -q automatic-bug-reporting-tool || automatic-bug-reporting-tool --version"}, {"label": "2. UPGRADE to newer than 2.7.0 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade automatic-bug-reporting-tool"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade automatic-bug-reporting-tool"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}]}, {"name": "linux", "vendor": "oracle", "type": "os", "affected": ["7"], "fixed": null, "safe": "before 7", "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "enterprise linux", "vendor": "redhat", "type": "os", "affected": ["6.0", "7.0"], "fixed": null, "safe": "before 6.0", "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "enterprise linux desktop", "vendor": "redhat", "type": "os", "affected": ["7.0"], "fixed": null, "safe": "before 7.0", "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "enterprise linux hpc node", "vendor": "redhat", "type": "os", "affected": ["7.0"], "fixed": null, "safe": "before 7.0", "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "enterprise linux server", "vendor": "redhat", "type": "os", "affected": ["7.0"], "fixed": null, "safe": "before 7.0", "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2015-5287"}, {"t": "Vendor Advisory", "u": "http://rhn.redhat.com/errata/RHSA-2015-2505.html"}, {"t": "Patch", "u": "https://github.com/abrt/abrt/commit/3c1b60cfa62d39e5fff5a53a5bc53dae189e740e"}, {"t": "Vendor Advisory", "u": "http://rhn.redhat.com/errata/RHSA-2015-2505.html"}, {"t": "Patch", "u": "https://github.com/abrt/abrt/commit/3c1b60cfa62d39e5fff5a53a5bc53dae189e740e"}], "cwe": ["CWE-59"], "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "L", "ac": "L", "pr": "L", "ui": "N"}, "remote": false, "exploit": true, "kev_due": "2026-09-09", "kev_added": "2026-08-26", "ransom": false, "priority": 85, "tier": "P0", "why": ["High severity", "EPSS top 8%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.92212, "pocs": [{"kind": "poc", "name": "HORKimhab/CVE-2015-5287 (0 stars)", "url": "https://github.com/HORKimhab/CVE-2015-5287", "stars": 0}, {"kind": "writeup", "name": "blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into", "url": "https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/"}, {"kind": "writeup", "name": "www.exploit-db.com/exploits/38832/", "url": "https://www.exploit-db.com/exploits/38832/"}, {"kind": "edb", "name": "ABRT - sosreport Privilege Escalation (Metasploit)", "url": "https://www.exploit-db.com/exploits/47421"}, {"kind": "edb", "name": "RHEL 7.0/7.1 - 'abrt/sosreport' Local Privilege Escalation", "url": "https://www.exploit-db.com/exploits/38832"}, {"kind": "edb", "name": "abrt (Centos 7.1 / Fedora 22) - Local Privilege Escalation", "url": "https://www.exploit-db.com/exploits/38835"}, {"kind": "msf", "name": "ABRT sosreport Privilege Escalation", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/abrt_sosreport_priv_esc.rb"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "retext", "status": "fixed", "fixed": "8.1.0-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-0602a84203", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-0602a84203", "note": "FEDORA-2026-0602a84203"}, {"os": "RHEL 7", "pkg": "abrt", "status": "fixed", "fixed": "abrt-2.1.11-35.el7", "cmd": "sudo dnf upgrade --advisory=RHSA-2015:2505\nrpm -q abrt", "url": null, "note": null}, {"os": "RHEL 7", "pkg": "libreport", "status": "fixed", "fixed": "libreport-2.1.11-31.el7", "cmd": "sudo dnf upgrade --advisory=RHSA-2015:2505\nrpm -q libreport", "url": null, "note": null}, {"os": "RHEL 6", "pkg": "abrt", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true}, {"id": "CVE-2015-3246", "publisher": "Red Hat, Inc.", "title": "Red Hat Libuser Race Condition Vulnerability", "summary": "libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.", "cvss": 7.4, "sev": "HIGH", "epss": 0.08503, "kev": true, "added": "2015-08-11", "pub": "2015-08-11T14:59:07.040", "modified": "2026-10-02T11:33:29.473", "products": [{"name": "enterprise linux", "vendor": "redhat", "type": "os", "affected": ["5.0", "6.0", "7.0"], "fixed": null, "safe": "before 5.0", "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "opensuse", "vendor": "opensuse", "type": "os", "affected": ["13.2"], "fixed": null, "safe": "before 13.2", "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "libuser", "vendor": "libuser project", "type": "app", "affected": ["< 0.56.13-8", ">= 0.60 and < 0.60-7"], "fixed": "0.56.13-8, 0.60-7", "safe": "before 0.60", "action": "upgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy libuser || rpm -q libuser || libuser --version"}, {"label": "2. UPGRADE to 0.56.13-8 (Debian / Ubuntu)", "cmd": "sudo apt update && sudo apt install --only-upgrade libuser"}, {"label": "2. UPGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "sudo dnf upgrade libuser"}, {"label": "Note", "cmd": "Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog."}, {"label": "3. If no update is available yet, DOWNGRADE to a release before 0.60 (Debian / Ubuntu)", "cmd": "apt-cache madison libuser\nsudo apt install libuser=<VERSION_BEFORE_0.60>\nsudo apt-mark hold libuser"}, {"label": "3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list libuser\nsudo dnf downgrade libuser-<VERSION_BEFORE_0.60>\nsudo dnf versionlock add libuser"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2015-3246"}, {"t": "Vendor Advisory", "u": "http://rhn.redhat.com/errata/RHSA-2015-1482.html"}, {"t": "Vendor Advisory", "u": "http://rhn.redhat.com/errata/RHSA-2015-1483.html"}, {"t": "Mitigation, Vendor Advisory", "u": "https://access.redhat.com/articles/1537873"}, {"t": "Vendor Advisory", "u": "http://rhn.redhat.com/errata/RHSA-2015-1482.html"}, {"t": "Vendor Advisory", "u": "http://rhn.redhat.com/errata/RHSA-2015-1483.html"}, {"t": "Mitigation, Vendor Advisory", "u": "https://access.redhat.com/articles/1537873"}], "cwe": ["CWE-264", "CWE-367"], "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack": {"av": "L", "ac": "H", "pr": "N", "ui": "N"}, "remote": false, "exploit": true, "kev_due": "2026-09-09", "kev_added": "2026-08-26", "ransom": false, "priority": 85, "tier": "P0", "why": ["High severity", "EPSS top 5%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.95035, "pocs": [{"kind": "poc", "name": "HORKimhab/CVE-2015-3246 (0 stars)", "url": "https://github.com/HORKimhab/CVE-2015-3246", "stars": 0}, {"kind": "writeup", "name": "blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into", "url": "https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/"}, {"kind": "writeup", "name": "www.exploit-db.com/exploits/44633/", "url": "https://www.exploit-db.com/exploits/44633/"}, {"kind": "writeup", "name": "www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt", "url": "https://www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt"}, {"kind": "edb", "name": "Libuser Library - Multiple Vulnerabilities", "url": "https://www.exploit-db.com/exploits/37706"}, {"kind": "edb", "name": "Libuser - 'roothelper' Local Privilege Escalation (Metasploit)", "url": "https://www.exploit-db.com/exploits/44633"}, {"kind": "msf", "name": "Libuser roothelper Privilege Escalation", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/libuser_roothelper_priv_esc.rb"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "no", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "python-streamlink", "status": "fixed", "fixed": "8.6.2-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-a56fcfdc08", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-a56fcfdc08", "note": "FEDORA-2026-a56fcfdc08"}, {"os": "Fedora ELN", "pkg": "valgrind", "status": "fixed", "fixed": "3.28.0-1.eln159", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-c593ef1d15", "note": "FEDORA-2026-c593ef1d15"}, {"os": "Ubuntu 20.04", "pkg": "libuser", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Ubuntu 22.04", "pkg": "libuser", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Ubuntu 24.04", "pkg": "libuser", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Ubuntu 24.10", "pkg": "libuser", "status": "not-affected", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Debian 12", "pkg": "libuser", "status": "fixed", "fixed": "1:0.62~dfsg-0.1", "cmd": "sudo apt update && sudo apt install --only-upgrade libuser\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' libuser)\" ge \"1:0.62~dfsg-0.1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Debian 13", "pkg": "libuser", "status": "fixed", "fixed": "1:0.62~dfsg-0.1", "cmd": "sudo apt update && sudo apt install --only-upgrade libuser\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' libuser)\" ge \"1:0.62~dfsg-0.1\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "RHEL 6", "pkg": "libuser", "status": "fixed", "fixed": "libuser-0.56.13-8.el6_7", "cmd": "sudo dnf upgrade --advisory=RHSA-2015:1482\nrpm -q libuser", "url": null, "note": null}, {"os": "RHEL 7", "pkg": "libuser", "status": "fixed", "fixed": "libuser-0.60-7.ael7b_1", "cmd": "sudo dnf upgrade --advisory=RHSA-2015:1483\nrpm -q libuser", "url": null, "note": null}, {"os": "RHEL 5", "pkg": "libuser", "status": "deferred", "fixed": null, "cmd": null, "url": null, "note": null}, {"os": "Amazon Linux 1", "pkg": "see advisory", "status": "fixed", "fixed": null, "cmd": "sudo yum update --advisory=ALAS-2015-572", "url": "https://alas.aws.amazon.com/cve/html/CVE-2015-3246.html", "note": "ALAS-2015-572"}], "vendors_checked": "2026-10-24T06:05:19.655601+00:00", "vendor_fixed": true}, {"id": "CVE-2015-5477", "publisher": "MITRE", "title": " ISC BIND Data Processing Errors Vulnerability", "summary": "named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.", "cvss": 7.5, "sev": "HIGH", "epss": 0.99409, "kev": true, "added": "2015-07-29", "pub": "2015-07-29T14:59:05.397", "modified": "2026-10-09T19:12:37.977", "products": [{"name": "junos", "vendor": "juniper", "type": "os", "affected": ["< 12.1", ">= 13.1 and < 13.2", "12.1", "12.1 r11", "12.1r", "12.1x44", "12.1x44 d10", "12.1x44 d15"], "fixed": "12.1, 13.2", "safe": "before 12.1", "action": "upgrade", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "fedora", "vendor": "fedoraproject", "type": "os", "affected": ["21", "22"], "fixed": null, "safe": "before 21", "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "enterprise linux", "vendor": "redhat", "type": "os", "affected": ["5.0", "6.0", "7.0"], "fixed": null, "safe": "before 5.0", "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "enterprise linux aus", "vendor": "redhat", "type": "os", "affected": ["6.4", "6.5", "6.6"], "fixed": null, "safe": "before 6.4", "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "debian linux", "vendor": "debian", "type": "os", "affected": ["7.0", "8.0"], "fixed": null, "safe": "before 7.0", "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "vm server", "vendor": "oracle", "type": "app", "affected": ["3.2"], "fixed": null, "safe": "before 3.2", "action": "downgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy vm-server || rpm -q vm-server || vm-server --version"}, {"label": "2. No fixed release: DOWNGRADE to a release before 3.2 (Debian / Ubuntu)", "cmd": "apt-cache madison vm-server\nsudo apt install vm-server=<VERSION_BEFORE_3.2>\nsudo apt-mark hold vm-server"}, {"label": "2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list vm-server\nsudo dnf downgrade vm-server-<VERSION_BEFORE_3.2>\nsudo dnf versionlock add vm-server"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2015-5477"}, {"t": "Mitigation, Third Party Advisory", "u": "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10718"}, {"t": "Patch, Vendor Advisory", "u": "https://kb.isc.org/article/AA-01272"}, {"t": "Mitigation, Third Party Advisory", "u": "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10718"}, {"t": "Patch, Vendor Advisory", "u": "https://kb.isc.org/article/AA-01272"}], "cwe": ["CWE-19", "CWE-617"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-10-11", "kev_added": "2026-10-08", "ransom": false, "priority": 91, "tier": "P0", "why": ["High severity", "EPSS top 1%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "Remotely exploitable, no login, no user action", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.99942, "pocs": [{"kind": "poc", "name": "robertdavidgraham/cve-2015-5477 (64 stars)", "url": "https://github.com/robertdavidgraham/cve-2015-5477", "stars": 64}, {"kind": "poc", "name": "elceef/tkeypoc (14 stars)", "url": "https://github.com/elceef/tkeypoc", "stars": 14}, {"kind": "poc", "name": "hmlio/vaas-cve-2015-5477 (1 stars)", "url": "https://github.com/hmlio/vaas-cve-2015-5477", "stars": 1}, {"kind": "writeup", "name": "kb.isc.org/article/AA-01272", "url": "https://kb.isc.org/article/AA-01272"}, {"kind": "writeup", "name": "kb.isc.org/article/AA-01306", "url": "https://kb.isc.org/article/AA-01306"}, {"kind": "edb", "name": "ISC BIND 9 - TKEY (PoC)", "url": "https://www.exploit-db.com/exploits/37721"}, {"kind": "edb", "name": "ISC BIND 9 - TKEY Remote Denial of Service (PoC)", "url": "https://www.exploit-db.com/exploits/37723"}, {"kind": "msf", "name": "BIND TKEY Query Denial of Service", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/dns/bind_tkey.rb"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "partial"}, "vendors": [{"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}, {"os": "Debian 12", "pkg": "bind9", "status": "fixed", "fixed": "1:9.9.5.dfsg-11", "cmd": "sudo apt update && sudo apt install --only-upgrade bind9\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' bind9)\" ge \"1:9.9.5.dfsg-11\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Debian 13", "pkg": "bind9", "status": "fixed", "fixed": "1:9.9.5.dfsg-11", "cmd": "sudo apt update && sudo apt install --only-upgrade bind9\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' bind9)\" ge \"1:9.9.5.dfsg-11\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "RHEL 5", "pkg": "bind", "status": "fixed", "fixed": "bind-9.3.6-25.P1.el5_11.3", "cmd": "sudo dnf upgrade --advisory=RHSA-2015:1514\nrpm -q bind", "url": null, "note": null}, {"os": "RHEL 5", "pkg": "bind97", "status": "fixed", "fixed": "bind97-9.7.0-21.P2.el5_11.2", "cmd": "sudo dnf upgrade --advisory=RHSA-2015:1515\nrpm -q bind97", "url": null, "note": null}, {"os": "RHEL 6", "pkg": "bind", "status": "fixed", "fixed": "bind-9.8.2-0.37.rc1.el6_7.2", "cmd": "sudo dnf upgrade --advisory=RHSA-2015:1513\nrpm -q bind", "url": null, "note": null}, {"os": "RHEL 6.4 Advanced Update Support", "pkg": "bind", "status": "fixed", "fixed": "bind-9.8.2-0.17.rc1.el6_4.7", "cmd": "sudo dnf upgrade --advisory=RHSA-2016:0078\nrpm -q bind", "url": null, "note": null}, {"os": "RHEL 6.5 Advanced Update Support", "pkg": "bind", "status": "fixed", "fixed": "bind-9.8.2-0.23.rc1.el6_5.2", "cmd": "sudo dnf upgrade --advisory=RHSA-2016:0078\nrpm -q bind", "url": null, "note": null}, {"os": "Amazon Linux 1", "pkg": "see advisory", "status": "fixed", "fixed": null, "cmd": "sudo yum update --advisory=ALAS-2015-573", "url": "https://alas.aws.amazon.com/cve/html/CVE-2015-5477.html", "note": "ALAS-2015-573"}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true}, {"id": "CVE-2015-3306", "publisher": "MITRE", "title": "ProFTPD Improper Access Control Vulnerability", "summary": "The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.", "cvss": 10.0, "sev": "CRITICAL", "epss": 0.99497, "kev": true, "added": "2015-05-18", "pub": "2015-05-18T15:59:10.743", "modified": "2026-10-09T16:17:18.210", "products": [{"name": "fedora", "vendor": "fedoraproject", "type": "os", "affected": ["20", "21", "22"], "fixed": null, "safe": "before 20", "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "debian linux", "vendor": "debian", "type": "os", "affected": ["7.0", "8.0", "9.0"], "fixed": null, "safe": "before 7.0", "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "tumbleweed", "vendor": "opensuse", "type": "os", "affected": ["all versions"], "fixed": null, "safe": null, "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "linux enterprise server", "vendor": "suse", "type": "os", "affected": ["15 sp7"], "fixed": null, "safe": "before 15", "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "linux enterprise server", "vendor": "suse", "type": "os", "affected": ["15 sp7"], "fixed": null, "safe": "before 15", "action": "mitigate", "steps": [{"label": "Check your OS release", "cmd": "cat /etc/os-release; uname -r"}, {"label": "Debian / Ubuntu", "cmd": "sudo apt update && sudo apt full-upgrade"}, {"label": "RHEL / Amazon Linux / Fedora", "cmd": "sudo dnf upgrade --refresh"}, {"label": "Windows", "cmd": "Install the latest cumulative update from Windows Update"}, {"label": "If no patch exists yet", "cmd": "OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure."}]}, {"name": "proftpd", "vendor": "proftpd", "type": "app", "affected": ["1.3.5"], "fixed": null, "safe": "before 1.3.5", "action": "downgrade", "steps": [{"label": "1. Check installed version", "cmd": "apt-cache policy proftpd || rpm -q proftpd || proftpd --version"}, {"label": "2. No fixed release: DOWNGRADE to a release before 1.3.5 (Debian / Ubuntu)", "cmd": "apt-cache madison proftpd\nsudo apt install proftpd=<VERSION_BEFORE_1.3.5>\nsudo apt-mark hold proftpd"}, {"label": "2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)", "cmd": "dnf --showduplicates list proftpd\nsudo dnf downgrade proftpd-<VERSION_BEFORE_1.3.5>\nsudo dnf versionlock add proftpd"}, {"label": "Downgrade risk", "cmd": "Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host."}, {"label": "After downgrade", "cmd": "Restart the service, and keep the package held until a fixed release ships."}]}], "refs": [{"t": "NVD", "u": "https://nvd.nist.gov/vuln/detail/CVE-2015-3306"}], "cwe": ["CWE-284"], "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack": {"av": "N", "ac": "L", "pr": "N", "ui": "N"}, "remote": true, "exploit": true, "kev_due": "2026-10-11", "kev_added": "2026-10-08", "ransom": false, "priority": 100, "tier": "P0", "why": ["Critical severity", "EPSS top 1%: very likely to be exploited", "Exploited in the wild (CISA KEV)", "Public exploit reference", "CISA SSVC: automatable with total technical impact", "Remotely exploitable, no login, no user action", "On your watchlist"], "fix": true, "watched": true, "epss_pct": 0.99946, "pocs": [{"kind": "poc", "name": "t0kx/exploit-CVE-2015-3306 (152 stars)", "url": "https://github.com/t0kx/exploit-CVE-2015-3306", "stars": 152}, {"kind": "poc", "name": "nootropics/propane (2 stars)", "url": "https://github.com/nootropics/propane", "stars": 2}, {"kind": "edb", "name": "ProFTPd 1.3.5 - 'mod_copy' Command Execution (Metasploit)", "url": "https://www.exploit-db.com/exploits/37262"}, {"kind": "edb", "name": "ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution", "url": "https://www.exploit-db.com/exploits/36803"}, {"kind": "edb", "name": "ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (2)", "url": "https://www.exploit-db.com/exploits/49908"}, {"kind": "edb", "name": "ProFTPd 1.3.5 - File Copy", "url": "https://www.exploit-db.com/exploits/36742"}, {"kind": "msf", "name": "ProFTPD 1.3.5 Mod_Copy Command Execution", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/ftp/proftpd_modcopy_exec.rb"}, {"kind": "nuclei", "name": "ProFTPd - Remote Code Execution", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2015/CVE-2015-3306.yaml"}], "pinned": false, "ssvc": {"exploitation": "active", "automatable": "yes", "impact": "total"}, "vendors": [{"os": "Fedora 46", "pkg": "uv", "status": "fixed", "fixed": "0.13.5-1.fc46", "cmd": "sudo dnf upgrade --advisory=FEDORA-2026-61ea5a28c6", "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-61ea5a28c6", "note": "FEDORA-2026-61ea5a28c6"}, {"os": "Debian 12", "pkg": "proftpd-dfsg", "status": "fixed", "fixed": "1.3.5-2", "cmd": "sudo apt update && sudo apt install --only-upgrade proftpd-dfsg\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' proftpd-dfsg)\" ge \"1.3.5-2\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}, {"os": "Debian 13", "pkg": "proftpd-dfsg", "status": "fixed", "fixed": "1.3.5-2", "cmd": "sudo apt update && sudo apt install --only-upgrade proftpd-dfsg\ndpkg --compare-versions \"$(dpkg-query -W -f='${Version}' proftpd-dfsg)\" ge \"1.3.5-2\" && echo PATCHED || echo STILL-VULNERABLE", "url": null, "note": null}], "vendors_checked": "2026-10-23T17:05:33.140855+00:00", "vendor_fixed": true}]}